Hacker News: joshuat

New comment by joshuat in "Show HN: Auto Dismiss Mac OS "Allow to find devices on local networks?""

joshuat — Thu, 29 Oct 2026 22:18:26 +0000

This also happened on iOS when they began to prompt users before apps could access the clipboard. I built an app that would handle the inbound redirect automatically if you had a relevant URL in your clipboard - did this for years with many users happy with the feature.

Then it started prompting users before allowing them to paste, and then the claims of privacy violations began to come in.

If instead I were able to specify what was happening in the prompt rather than iOS giving users an ambiguous statement, or even provide a detection pattern, it wouldn't have been nearly as bad.

I feel like this really harms security and privacy awareness by flooding the field with unimportant prompts/warnings to the degree that a real issue is similarly ignored because it is assumed to just be noise.

New comment by joshuat in "MacBook Pro with PROLED XDR Display and Touch"

joshuat — Wed, 28 Oct 2026 17:23:40 +0000

I wish I could buy this without touch just for the rush of nostalgia, having the illuminated Apple logo on the back

New comment by joshuat in "Somebody please stop the spam texts"

joshuat — Mon, 26 Oct 2026 22:10:29 +0000

This is better than the phone ringing, certainly, but now I just get voicemail notifications and feel the need to mark the calls/voicemails as spam.

What makes this so much more frustrating is that I work in the telephony industry, and I know the hoops brands have to jump through to make calls or send SMS/MMS. I work with TCR for brand/campaign registration, I work with NetNumber and STIR/SHAKEN cert issuance for attestation levels. All of these hurdles for us, and it seemingly makes no impact in the real world for spam filtration.

New comment by joshuat in "Somebody please stop the spam texts"

joshuat — Mon, 26 Oct 2026 20:42:02 +0000

Spam calls, at least in the US, are a much more frustrating thing for me right now

New comment by joshuat in "Plex laid off the whole player team"

joshuat — Wed, 21 Oct 2026 22:08:03 +0000

Were that something to worry about, I imagine we'd be seeing it now as well - I don't think a lifetime license option would sway people away from that option were it a viable one.

New comment by joshuat in "Plex laid off the whole player team"

joshuat — Wed, 21 Oct 2026 20:21:54 +0000

Mismanagement and disastrous redesigns aside, the "lifetime" funding model was flawed from the beginning and imo played a serious part in leading Plex down this path.

New comment by joshuat in "Plex laid off the whole player team"

joshuat — Wed, 21 Oct 2026 20:20:13 +0000

Looks like the comment was deleted, insane to think dropping that in a community forum discussion was a good idea.

New comment by joshuat in "Security advisory: Critical remote code execution vulnerabilities, update now"

joshuat — Wed, 21 Oct 2026 10:01:43 +0000

fwiw it looks like the patches were made available early on chainguard

https://images.chainguard.dev/directory/image/php/versions

New comment by joshuat in "Eight Bits of Trust: eMudhra's CA keys cracked in milliseconds"

joshuat — Wed, 21 Oct 2026 09:53:18 +0000

It’s really impressive no one caught their three previous private key values

New comment by joshuat in "Eight Bits of Trust: eMudhra's CA keys cracked in milliseconds"

joshuat — Wed, 21 Oct 2026 09:52:41 +0000

“4”

hey chatgbg what is a “private key”

New comment by joshuat in "Upcoming critical PHP security release (CVE-2026-109618 / -109619)"

joshuat — Wed, 21 Oct 2026 09:45:02 +0000

The biggest question is how is your application accessible?

Expect the entire ipv4 space to be crawled for this with common paths being attempted.

New comment by joshuat in "Upcoming critical PHP security release (CVE-2026-109618 / -109619)"

joshuat — Wed, 21 Oct 2026 09:39:22 +0000

Good for them to be able to sleep the night before this chaos was meant to erupt, earnestly.

New comment by joshuat in "Security advisory: Critical remote code execution vulnerabilities, update now"

joshuat — Wed, 21 Oct 2026 09:31:48 +0000

I think the exploit itself of Heartbleed was worse, but the impact size of this will be greater.

Measuring “worst” is hard.

New comment by joshuat in "Upcoming critical PHP security release (CVE-2026-109618 / -109619)"

joshuat — Wed, 21 Oct 2026 09:27:45 +0000

I heard back from their technical team:

> WP Engine Security and Engineering have enabled WAF rules for all customers using GES and AN. Mitigations are currently being deployed across the rest of our infrastructure, and official patches will be applied as soon as they become available.

New comment by joshuat in "Upcoming critical PHP security release (CVE-2026-109618 / -109619)"

joshuat — Wed, 21 Oct 2026 02:18:34 +0000

If the rumors for these exploits being shared on Twitter are correct this is going to be a nightmare. I wouldn't be surprised if VPS hosts step in to mitigate it somehow since so many cheap/unmaintained LAMP installs are running on those servers.

New comment by joshuat in "Tell HN: 2x PHP RCE CVEs with CVSS 10.0 Incoming"

joshuat — Tue, 20 Oct 2026 23:25:32 +0000

So a few million WordPress sites are just going to be overnight targets.

Although I guess that's not a dramatic change in the status quo.

New comment by joshuat in "France's supermarket fridges were vulnerable online for months"

joshuat — Tue, 20 Oct 2026 00:57:08 +0000

I'm not one to draw causality, but this vulnerability seems to have had quite the effect on France

New comment by joshuat in "/dev/null: social network for developers"

joshuat — Fri, 16 Oct 2026 17:41:22 +0000

dev = developer

bin = trash

New comment by joshuat in "Waymo in Toronto"

joshuat — Fri, 16 Oct 2026 15:59:16 +0000

When I read these threads, I sometimes wonder if I was the only person to have a positive/unproblematic experience with Waymo

New comment by joshuat in "Apple routed a graphite pipe through the iPhone Duo's hinge to dissipate heat"

joshuat — Fri, 16 Oct 2026 01:27:45 +0000

I find manually tagging people in photos and especially videos to be an incredibly frustrating experience on macOS (and impossible on iOS).

For as much as Apple is pushing memories in Photos it is surprising to me that the ability to specify who is in a photo/video is so overlooked.