Recent submissions

Comment · 6 hours ago
To the best of my understanding, ZDR is often a promise that your data is not used for model training. It doesn't mean "what it says on the tin", so to speak. There are cases where data needs to be retained regardless, for example, preventing abuse. This isn't for training, so a company can still claim ZDR.
Comment · 6 hours ago
I did some research and corroborated with Claude. No banks in my country offer anything akin to Privacy.com. There are a few "virtual card" services but they have limits that make them virtually unusable.

I doubt I'll have any influence on the products any one bank in my country offers, but it doesn't hurt to ask.

Comment · 9 hours ago
My bank is the opposite of yours. They used to offer a similar service but shuttered it a few years ago. A shame.
Comment · 9 hours ago
As someone who has helped to secure critical national infrastructure several years ago, I can say that it was a mess to disclose the vulnerabilities I identified, and in some cases it took years to patch them. Some of these vulnerabilities were RCEs and mass PII leaks. It's simply not worth the risk for most people - who aren't in the USA - to bother doing this sort of security research. However, if you are in the USA, there are provisions in the CFAA that enable good-faith security research to take place (https://www.justice.gov/archives/opa/pr/department-justice-a...), so to the best of my understanding, you're able to do good-faith research without being charged or prosecuted, and you should take advantage of this if you have the skills or models to do so. I am not based in the USA, and there are no laws in my country that guarantee me zero jail time for simply trying to do the right thing, so I am not incentivized to continue finding vulnerabilities in my country's infrastructure.

Edit: If other countries don't catch up and include similar provisions in their laws, they'll simply fall behind and put their citizens at risk. I'm sure every country has individuals willing to help that currently feel unsafe - look at the large amount of bug bounty hunters worldwide who, I'm sure, wouldn't mind practicing their skills by securing their country's infrastructure.

Comment · 9 hours ago
This is good advice for anyone who lives in the USA, but there are hardly any adequate alternatives for the rest of the world, as far as I know.
Comment · 9 hours ago
Credit for the video should go to the link referenced in https://news.ycombinator.com/item?id=50199757 (catgirl.cloud). The Twitter user reposted the video and did not credit the OP as far as I know.
Comment · 9 hours ago
Please forgive my stupidity, but is there any particular reason why companies never seem to disclose what "system" of theirs was breached? If this breach came about as a result of a security incident at a third-party, would it not benefit everyone minus the vendor to shift the blame? I understand that they say "our systems", but I've seen companies say this before when what they mean is "a system controlled by a vendor we contracted".
Comment · 19 days ago
Hi. I was briefly following the developments regarding legal representation and thought everything was going well. Is there anything more you could disclose as to how you were misled or what happened here? Thank you again for creating and maintaining Nitter, it's such a valuable tool and I've donated a few times over the years.
Comment · 1 month ago
Not an ad or promotion, I'm just also addicted to buying cool domains and I remember seeing this up for sale: DomainEmpire.com is currently trying to sell sesqui.net, registered in 1987, for $33,000. I think they have others that are cheaper, but you'll have to scrape WHOIS data for each domain to find their creation dates.
Comment · 1 month ago
I don't really care if anything else gets blocked as a side effect, except for Find My. As far as I know, `fmfd` and `findmydeviced` are the binaries responsible for that feature, so if I whitelist those binaries I should be fine.

Through my own usage of Little Snitch, it appears that all the iCloud-related features use individual binaries and that iCloud connections go to specific hosts for specific use cases (e.g. pxxx-contacts.icloud.com, pxxx-quota.icloud.com, pxxx-caldav.icloud.com). I'd assume the AI features are the same - specific hosts and binaries that I can block.

Comment · 1 month ago
Is it possible to block Apple Intelligence from sending data over the Internet via Little Snitch? I would assume it is, but I'm not sure if anything significant has changed in macOS 27 that makes this impossible now. I don't really mind the local features - I'd rather they stay disabled, but it's not the end of the world - but I really don't want any data leaving my Mac.
Comment · 2 months ago
This would be nice, and I hope I get to see a future like this, but I moreso meant that I don't see a solution for this issue given the current landscape of things. Ideally, yes, companies wouldn't collect the data and it would be illegal to do so. However, this currently isn't the case, so what can be done that lets all sides win? Something has to give, and I'm certain users will receive the short end of the stick at all times - at least, until there are better laws in place.
Comment · 2 months ago
Metabase can be self-hosted, but you cannot self-host Salesforce or Mixpanel or many of the other products I'm referring to. In an ideal world, every company would self-host their own instances of all of their products, since that ultimately forces them to be solely responsible for their customers' data. Using the cloud versions of these products shifts the blame from the company itself to the vendor when things go sideways, so it makes more sense for them to do this instead of taking responsibility.

Live from the official Hacker News API

A modern reader for Hacker News · SvelteKit + Skeleton