Hacker News: asqueella

New comment by asqueella in "Omarchy: Any User Process Can Escalate to Root"

asqueella — Mon, 31 Aug 2026 00:26:30 +0000

Has it restarted losing your session to install an "Intel Corporation - Extension - 22.1120.5.12" yet?

New comment by asqueella in "Omarchy: Any User Process Can Escalate to Root"

asqueella — Sun, 30 Aug 2026 23:49:58 +0000

The obvious difference is that you have to create that other user (as opposed to denying the ~/Documents request). Also when you curl|bash you normally want to install under current user -- not something you're supposed to do on Linux.

I don't actually believe that macOS protects me here, as I granted this permission to the terminal five years ago...

New comment by asqueella in "Pass the Passkey: A Novel Attack Surface in Passwordless Authentication"

asqueella — Wed, 05 Aug 2026 23:14:15 +0000

While you are technically correct, I know for sure that an RP might be unaware that not requiring user verification means Chrome is free to let malware steal the passkey... (Our Keycloak is (mis)configured like that.)

Do you happen to know if this is because Google had to implement sync in userspace, or is it an inherent limitation that could also affect Apple?

New comment by asqueella in "Pass the Passkey: A Novel Attack Surface in Passwordless Authentication"

asqueella — Wed, 05 Aug 2026 22:39:45 +0000

Sure, not giving out the secrets to userspace was the design goal of security keys and later TPM+Secure enclave. Passkeys happen to enable the use of such hardware for authentication on the web.

This post claims that before 2025 passkeys used to default to device-bound for Windows Hello and Chrome: https://www.reddit.com/r/Passkeys/comments/1o1j3fk/comment/n... — so it doesn't seem as clear-cut as you claim.

I thought it was maybe a case of convenience trumping security, as by definition you can't sync device-bound passkeys. But it's not clear why synced passkeys must be available for malware to steal (especially without user interaction).

I'm not sure now if the Apple's implementation has similar flaws with stealer malware on macOS: you don't see passkeys explicitly mentioned in mac stealer reports, but I couldn't quickly find a confirmation they are safe either...

New comment by asqueella in "Pass the Passkey: A Novel Attack Surface in Passwordless Authentication"

asqueella — Wed, 05 Aug 2026 02:45:47 +0000

I thought the point of storing secrets in hardware TPM and not giving them out into userspace (i.e. passkeys instead of passwords) is protecting against malware as well.

And they claim that for Chrome on Windows:

> Unlike a legitimate user flow that requires user interaction and device unlock, this attack shows how malware can obtain the required signature silently, without user consent, biometrics, device unlock or elevated privileges.

New comment by asqueella in "Qwen3.8-Max: A New Bar for Coding and Cowork"

asqueella — Wed, 05 Aug 2026 02:11:01 +0000

Not a novel idea!

https://xcancel.com/jurijkovalenok1/status/18632434621133989... (Herluf Bidstrup's "Automation")

New comment by asqueella in "Couple pay >$800k for a gene-editing therapy for their daughter. She died."

asqueella — Thu, 23 Jul 2026 21:52:21 +0000

I was curious what non-fatal condition would make the parents so desperate (to participate in a first-in-human trial):

> Mei was diagnosed with global developmental delay .. some of Mei’s behaviors .. were associated with autism.

> CHD3 mutations produce a condition called Snijders Blok-Campeau syndrome

> people with the mutation often have a normal life expectancy, but their symptoms vary widely. Most have slightly larger than normal heads, and about two-thirds have intellectual deficits. Moderate to severe cases may be nonverbal, suffer from seizures and heart problems, and have fluid-filled voids in their heads.

New comment by asqueella in "Nativ: Run frontier open models locally on your Mac"

asqueella — Mon, 20 Jul 2026 19:25:37 +0000

Bionic is an agent; this appears to be an open-source competitor to lmstudio. The initial commit is just a few hours ago though, so …

New comment by asqueella in "Telegram's t.me domain has been suspended"

asqueella — Tue, 14 Jul 2026 10:14:23 +0000

I thought this was a long solved problem: the server syncs encrypted data, and the user provides the decryption key from another device (via QR codes, BLE, …)

New comment by asqueella in "The HTML Element"

asqueella — Thu, 02 Jul 2026 00:38:58 +0000

Seems Chrome-only for now. But the spec (Working draft) has an editor from Mozilla as well, so maybe someday... https://w3c.github.io/mediacapture-extensions/#the-usermedia...

New comment by asqueella in "Anonymous GitHub account mass-dropping undisclosed 0-days"

asqueella — Tue, 30 Jun 2026 08:49:13 +0000

Don't let the hype turn you into a cynic. You're replying to a Rust core team member, who explicitly says the issues are mostly minor, across Rust ecosystem and not in Rust itself, and that they're filing them manually to avoid dumping unreviewed AI output on people.

It's easy to find the 37 issues they have already filed: https://github.com/search?q=soundness+gemini++author%3AManis...

New comment by asqueella in "Stack Overflow’s forum is dead but the company’s still kicking"

asqueella — Tue, 26 May 2026 19:03:42 +0000

https://software.codidact.com/ was created after one of the many SO dramas. It doesn't come up in searches though and I didn't have reason to use it...

New comment by asqueella in "Maybe you shouldn't install new software for a bit"

asqueella — Sat, 09 May 2026 11:56:30 +0000

Thanks for not deleting your question — I misunderstood the OP in the same way.

New comment by asqueella in "A new spam policy for “back button hijacking”"

asqueella — Tue, 14 Apr 2026 11:53:56 +0000

Surely the browser could enforce a limit on a domain, and make sure that the real page you came from (typically the search engine) is prominently displayed.

New comment by asqueella in "Show HN: Moonshine Open-Weights STT models – higher accuracy than WhisperLargev3"

asqueella — Tue, 24 Feb 2026 23:53:08 +0000

For those wondering about the language support, currently English, Arabic, Japanese, Korean, Mandarin, Spanish, Ukrainian, Vietnamese are available (most in Base size = 58M params)

New comment by asqueella in "Show HN: I built a macOS tool for network engineers – it's called NetViews"

asqueella — Tue, 10 Feb 2026 20:28:00 +0000

People outside US may be able to pay through App store, but not through whatever payment processor you use.

New comment by asqueella in "Why is the sky blue?"

asqueella — Mon, 09 Feb 2026 20:57:38 +0000

The explanation that made it click for me a while ago was by someone who implemented a shader https://www.alanzucconi.com/2017/10/10/atmospheric-scatterin... — the explanations that don't end up producing an image all seemed to skip over one detail or another.

New comment by asqueella in "Electron-based apps cause system-wide lag on macOS 26 Tahoe"

asqueella — Fri, 26 Sep 2025 08:59:19 +0000

This is what an Apple engineer could write in the electron's github issue if they refused to fix it.

We're not discussing that, but that they have pushed an update without proper testing. You can see from the other comments that breakage is not limited to people using private methods.

New comment by asqueella in "Electron-based apps cause system-wide lag on macOS 26 Tahoe"

asqueella — Thu, 25 Sep 2025 19:39:50 +0000

No, for "pushing out updates that cause issues [with very common software]".

New comment by asqueella in "Ask HN: The government of my country blocked VPN access. What should I use?"

asqueella — Fri, 29 Aug 2025 09:12:33 +0000

The site is awful, and I couldn't find the technical description easily. I assume it runs an exit node for other people's traffic?