Hacker Newsnew | past | comments | ask | show | jobs | submit | synack's commentslogin

Reads like AI. Not sure what OAuth/JWT has to do with Layer 3.

This is pretty standard for specification documents, probably more accurate to say AI sounds like them than the other way around.

Ignoring the particular technologies used (OAuth/JWT) it looks like they’re adding more auth to the devices themselves; think two computers connected to the same network switch not being able to impersonate each other.


Are they considering all uses of window.history.pushState to be hijacking? If so, why not remove that function from Chrome?

Because clicking on a navigation button in a web app is a good reason to window.history.pushState a state that will return the user to the place where they were when they clicked the button.

Clicking the dismiss button on the cookie banner is not a reason to push a state that will show the user a screen full of ads when they try to leave. (Mentioning the cookie banner because AFAIK Chrome requires a "user gesture" before pushState works normally, https://groups.google.com/a/chromium.org/g/blink-dev/c/T8d4_...)


It's a valid question how they detect it. As there are valid usages, just checking for the existence of the function call would not be correct.

These sites likely pushState on consent actions so it appears like any user interaction.


No idea how they actually do it, but I wouldn't be surprised if manual reports and actions play a big role. The policy doesn't need to be enforced reliably as long as it is plausible for reasonably big actors to get caught sooner or later and the consequences of getting caught are business-ruining.

But detecting it on a technical level shouldn't be hard either. Visit the page, take a screenshot, have an AI identify the dismiss button on the cookie/newsletter popups, scroll a bit, click something that looks inactive, check if the URL changes, trigger the back action. Once a suspicious site is identified, put it in the queue for manual review.


The URL does not even need to change, you can pushState with just a JavaScript object, catch the pop and do something like display a modal. (I use this pattern to allow closing fullscreen filter overlays the user opened)

Still, requires user interaction, on any element, once. So the crawler needs to identify and click most likely the consent/reject button. Which may not even trigger for Googlebot.

So they likely will rely on reports or maybe even Chrome field data.


Field data is a great point - it should be really obvious when people click "back", and many then click back again immediately after (or close the tab, or whatever people do to "escape").

No, only if your website abuses window.history.pushState to redirect the user to spam/ad content is it considered abuse.

mkfs.ext4 defaults to 5% reserved for root. -m 0 to turn it off.

I wasn't aware of these glasses, pretty cool. Not sure I'm ready to drop that much money on a pair with prescription lenses though.

Would be useful to have my multimeter display in my field of view when heads down debugging a circuit. There are a few bluetooth meters on the market, so I think this is doable?

Looking at the SDK, the fixed LVGL font is a bummer. Ideally I'd like to have a raw framebuffer to control, though I imagine this is difficult to do over bluetooth without blowing your power budget. Maybe you could have a custom indexed tilemap and push sprites around?


Yet Sourceforge has been putting ads on open source projects for decades.


Yeah, that's part of why nobody wants to use Sourceforge.


Ironically, that's what probably killed Sourceforge and helped GitHub take off. It remains to be seen whether Codeberg will now repeat the process.


SF required application form, where you had to explain why you are worthy to have your git repo hosted by SF. By the time they processed it I already forgot I even applied. I think that was actual reason for them being destroyed by GitHub, that had simple, fully automated signup.


yeah, uh you're definitely driving home the point here. that's why no one uses sourceforge anymore.


Wow, I haven't heard that name for decades.


Jeez, that makes me feel old, and I am "only" just barely in 30. :(

Remember https://web.archive.org/web/20050204100149/http://cia.navi.c... BTW?

For the uninitiated: https://web.archive.org/web/20050129022102/http://cia.navi.c.... :D Good times!

This takes me back. It is just one of those artifacts of early 2000s that was associated with open source hacker culture. It truly felt magical at the time.


Is the Linux scheduler aware of shared CPU cache hierarchies? Is there any way we could make the scheduler do better cache utilization rather than pinning processes to cores or offloading these decisions to vendor specific code?


Library of Congress has some well considered recommendations for archival. https://www.loc.gov/preservation/resources/rfs/TOC.html

For web content they recommend gzipped WARC. This is great for retaining the content, but isn’t easy to search or render.

I do WARC dumps then convert those to ZIM for easier access.



Micron is building a bunch of new fabs in the US right now- two in Idaho, two in New York, and modernizing one existing fab in Virginia. The first Idaho fab will come online in 2027 and NY/Virginia fabs in 2030.

https://www.micron.com/us-expansion

So, more chips coming soon, but who knows if that's enough to keep up with demand for the next few years.


Could say the same about Postgres. People like their databases.


Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: