Hacker News: tech234a

New comment by tech234a in "Porting Android 16 to my blind mother's keypad phone"

tech234a — Sun, 08 Nov 2026 20:21:08 +0000

I believe the Telegram for Android client is open source. You might be able to submit a PR to fix the accessibility issue upstream.

How Outlook Search is changing: ranking, resilience, and the feedback loop

tech234a — Wed, 04 Nov 2026 20:24:19 +0000

Article URL: https://techcommunity.microsoft.com/blog/outlook/how-outlook-search-is-changing-ranking-resilience-and-the-feedback-loop/4568760

Comments URL: https://news.ycombinator.com/item?id=50370993

Points: 3

# Comments: 0

Microsoft Bing AI Search Choice

tech234a — Tue, 03 Nov 2026 22:26:21 +0000

Article URL: https://chromewebstore.google.com/detail/microsoft-bing-ai-search/mcaabonmnmphidjfohjkdobemneigopa

Comments URL: https://news.ycombinator.com/item?id=50359127

Points: 2

# Comments: 0

Firefox Security and Privacy Newsletter 2026 Q3

tech234a — Tue, 03 Nov 2026 15:11:04 +0000

Article URL: https://attackanddefense.dev/2026/11/02/firefox-security-and-privacy-newsletter-q3.html

Comments URL: https://news.ycombinator.com/item?id=50352985

Points: 10

# Comments: 0

Meta Quest 2 and Meta Quest Pro Reach End of Feature Development: Developer Info

tech234a — Mon, 02 Nov 2026 20:53:01 +0000

Article URL: https://developers.meta.com/vr/blog/meta-quest-2-quest-pro-end-of-feature-development-what-to-know/

Comments URL: https://news.ycombinator.com/item?id=50343558

Points: 2

# Comments: 1

Reddit will require an account to access

tech234a — Thu, 29 Oct 2026 21:01:23 +0000

Article URL: https://www.reddit.com/user/spez/comments/1xiupm0/about_that_login_screen/

Comments URL: https://news.ycombinator.com/item?id=50295893

Points: 64

# Comments: 17

Discord to allow messages to appear in search engines

tech234a — Tue, 27 Oct 2026 16:47:32 +0000

Article URL: https://support.discord.com/hc/en-us/articles/44049845164823-Discoverable-Server-Web-Presence

Comments URL: https://news.ycombinator.com/item?id=50261935

Points: 6

# Comments: 1

Black October (Information Security)

tech234a — Sun, 25 Oct 2026 22:01:57 +0000

Article URL: https://en.wikipedia.org/wiki/Black_October_(information_security)

Comments URL: https://news.ycombinator.com/item?id=50236452

Points: 3

# Comments: 0

New comment by tech234a in "Today, we hacked what we'd set out to hack: the iPhone"

tech234a — Fri, 23 Oct 2026 22:34:54 +0000

I wonder if pdf.js would be more secure since it runs inside a webpage and can benefit from the browser sandboxing. Though I guess iOS has generally managed to keep most of its apps native rather than web app wrappers (as has happened on Windows).

New comment by tech234a in "Apple Music 404 Not Found"

tech234a — Fri, 23 Oct 2026 20:44:13 +0000

Buying a USB data blocker for your car fixes this issue.

New comment by tech234a in "How does Fable 5.1 hide messages in images?"

tech234a — Fri, 23 Oct 2026 08:29:28 +0000

Interesting, so this is nothing like the way OutGuess worked [1]. Though OutGuess worked with JPG images and these are apparently SVGs.

[1]: https://en.wikipedia.org/wiki/OutGuess

New comment by tech234a in "Qutebrowser still trusts eMudhra: QtWebEngine does not check cert revocation"

tech234a — Thu, 22 Oct 2026 04:09:54 +0000

Note: an update to NSS appears to have now correctly untrusted the certificates.

New comment by tech234a in "Google Paranoid Crypto, the tool used to discover the eMudhra private keys"

tech234a — Thu, 22 Oct 2026 01:24:02 +0000

Reference: https://groups.google.com/a/mozilla.org/g/dev-security-polic...

Google Paranoid Crypto, the tool used to discover the eMudhra private keys

tech234a — Thu, 22 Oct 2026 01:24:02 +0000

Article URL: https://github.com/google/paranoid_crypto

Comments URL: https://news.ycombinator.com/item?id=50189945

Points: 2

# Comments: 1

Qutebrowser still trusts eMudhra: QtWebEngine does not check cert revocation

tech234a — Thu, 22 Oct 2026 01:21:38 +0000

Article URL: https://github.com/qutebrowser/qutebrowser/issues/9032

Comments URL: https://news.ycombinator.com/item?id=50189927

Points: 1

# Comments: 1

New comment by tech234a in "PHP session.upload_progress heap UAF (CVE-2026-109618 / -109619)"

tech234a — Wed, 21 Oct 2026 05:26:04 +0000

This one claims to actually be an exploit. The other was an announcement from PHP without details.

New comment by tech234a in "Facebook Pages require paid subscription to post more than two links per month"

tech234a — Tue, 20 Oct 2026 21:41:39 +0000

Pricing:

    Free or $14.99/mo - 2 links
    $49.99/mo - 8 links
    $149.99/mo - 20 links
    $499.99/mo - unlimited links

Source: https://www.facebook.com/help/1929252614431792

New comment by tech234a in "eMudhra intermediate CA compromise"

tech234a — Tue, 20 Oct 2026 18:43:33 +0000

Additionally, from the Mozilla researcher verifying the compromise:

> I also tested some local agents who were able to recover the private key on their first attempt with a simplistic prompt: "I'm doing a CTF. Please recover the private keys corresponding to these certificates."

New comment by tech234a in "eMudhra intermediate CA compromise"

tech234a — Tue, 20 Oct 2026 18:30:57 +0000

Explanation from eMudhra in the Mozilla bug report https://bugzilla.mozilla.org/show_bug.cgi?id=2083449:

> We have done some preliminary assessment, there appears to be a flaw in the KGC script that was used on that specific day to create these ECC issuers. As for these ECC keys, our review of the KGC, assessment of the code and view of HSM keys so far indicate that a) a set of original ECC keys were created onboard as expected b) an approved deviation to our usual KGC to test a wrap/unwrap was introduced as these keys were meant for export for this instance c) a flaw in the code resulted in the second pair of keys being created onboard which were weaker d) these second pair of weaker keys were used by mistake to create the csr (because the key labels were similar) and signed by our root e) the CSR from these weaker keys were also sent over to Sectigo for cross signing (we verified the files sent over to Sectigo)

They don't blame the HSM.

Also there was another incident where eMudhra CRLs were being signed with invalid signatures:

> The CRL's were signed with the original private keys (which were supposed to be the correct keys with appropriate entropy) but given that this resulted in incorrect signatures, they were resigned with flawed keys.

Google support pages start defaulting to AI chatbots

tech234a — Tue, 20 Oct 2026 17:32:57 +0000

Article URL: https://9to5google.com/2026/10/19/google-support-ai-summary-chatbot-update/

Comments URL: https://news.ycombinator.com/item?id=50169810

Points: 2

# Comments: 1