Hacker Newsnew | past | comments | ask | show | jobs | submit | purkka's commentslogin

You can do this way easier by just copying the HTML/CSS and modifying what you need. Going through Figma is entirely unnecessary for making a scam site.


All Apple mobile devices I've used have had some form of low-level forced reboot method, akin to holding down your PC's power button. Though I can't say whether it's also something one could subvert with a BootROM exploit.

https://support.apple.com/guide/iphone/force-restart-iphone-...


Nope, the kernel can load static ELF binaries. ld.so is only needed for dynamically linked binaries, and in fact many Go applications (for example, as they're statically linked) ship as containers with nothing but the single binary.


You can do this on macOS too, if you're willing to break all forward/backward compatibility and make direct syscalls you can have a purely static binary. Without the LC_LOAD_DYLINKER command on the mach-o binary the kernel should just jump to the entrypoint based on LC_UNIXTHREAD. (This may not longer work on arm machines though if they actually trap on direct syscalls not through libSystem, similar to the BSDs)


Thanks. I completely forgot about static binaries.


Of course ld-linux itself is an ELF binary. The kernel loads it.


Not only is it an ELF binary, but it is ironically a static ELF binary.


I've found this to be effective as well. Claude generally immediately identifies the stupid code pattern it used and tries to fix it (with somewhat varying results).


Any four letter fun word in all caps seems to trigger very similar behavior to “please double check what you just did/said and look for gaps”


90% of 30% of total energy use. So, actually 27%. What a title.


I wonder how this compares to GrapheneOS in practice.

>Operated by Murena, your Murena Workspace account @murena.io is at the centre of the ecosystem, allowing to store, back up and retrieve your data safely on remote servers.

This sounds like their version is somewhat married to Murena. While probably better than Google, still not independent.

They're also advertising features such as "hiding your IP address [...] when you feel like it" – which sounds a lot like a VPN – without mentioning much about who the traffic is going through or how they might log it.


> I wonder how this compares to GrapheneOS in practice.

https://eylenburg.github.io/android_comparison.htm is a fairly complete comparison. One of GrapheneOS' biggest features is that they sandbox Google services (if you choose to install them), whereas e/OS gives them privileged access by default (via microG). Calling it a "degoogled" OS while microG uses Google's proprietary blobs is... a choice.

The GrapheneOS developers are very sceptical of e/OS (https://xcancel.com/GrapheneOS/search?f=tweets&q=e/os), but you should obviously take biases into account here. Murena's CEO occasionally participates too: https://xcancel.com/gael_duval/search?f=tweets&q=grapheneos


I'm on /e/OS and don't use Murena Workspace (which I think is just a Nextcloud instance that they host). For the past couple of years in which I've used it, I have felt zero pressure to use Murena Workspace. Though I imagine it might be neat if you host your own Nextcloud instance, which might be nicely integrated too.

(That said, yes, I don't quite trust their VPN or app store, since it's unclear who's running it - in the latter's case, I imagine that's also a legal matter.)


Yeah it really looks like they are trying to solve too many things.

This is usually not a good sign.

I'd prefer to have an OS provider that does one thing well.


The hide your ip address feature routes your traffic through Tor: https://doc.e.foundation/support-topics/advanced_privacy#hid...

You can do this on any other android device using an app like Orbot or Tor VPN beta


The Europeans have already cooperated with Americans so that each could read each other's citizens' private messaging which would be illegal for the locals.

Keeping the data overseas by design would just make this easier.

https://en.wikipedia.org/wiki/Operation_Trojan_Shield


Greylisting is great until it delays your email login/signup verification codes for 20 minutes. Especially if they expire in 15.

I guess this only shows how email is used for entirely orthogonal purposes now.


I have an auto-whitelist if my greylisting has been handled properly, which means that, the first signup email is indeed invalid, but the second works.

On rare occasions I get frustrated by this, and I'm forced to login via ssh and manually permit a greylisted address through - though normally I am not so time sensitive. My greylisting is only 5 minutes.


I tend to despise senders that believe email is always an effective real-time channel. Delays happen for all sorts of reasons, ranging from massive outages to scanning incoming emails for spam or malware (my corporate email is sloooow).

Greylisting has been so effective for my personal email, I don't mind waiting a bit on the rare occasion (by now, most senders are already recognized). And on the rare occasion I get spam, it's been cathartic, adding a rule to reject the sender with a quippy SMTP eerror. It's also been easy enough just to forward it to abuse@google.com, because it's almost always from Gmail.


Unless you whitelist the notification email, which I've has to do a few times.


Whitelisting doesn't work if one doesn't know the email domain name the service will use.

An Amazon verification email will be sent from "account-update@amazon.com". It's intuitive to predict "@amazon.com" so whitelisting works.

However, State Farm Insurance login verification codes are actually sent from "noreply@sfauthentication.com" instead of the "@statefarm.com"


Per the tweet linked in the article there were also random bans in addition to the ban feed shitposting.

https://x.com/KingGeorge/status/2004902566434668686


Copy of tweet:

>@KingGeorge

>Seems like R6 is completely fucked. It’s unreal how bad.

>Hackers have done the following.

>1. Banned + unbanned thousands of people.

>2. Taken over the ban feed can put anything.

>3. Gave everyone 2 billion credits + renown.

>4. Gave everyone every skin including dev skins.

>5:09 AM · Dec 27, 2025


Python has LiteralString for this exact purpose. It's only on the type checker level, but type checking should be part of most modern Python workflows anyway. I've seen DB libraries use this a lot for SQL parameters.

https://typing.python.org/en/latest/spec/literal.html#litera...


Beyond LiteralString there is now also t-strings, introduced in Python 3.14, that eases how one writes templated strings without loosing out on security. Java has something similar with Template class in Java 21 as preview.


Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: