Hacker News: ylk

New comment by ylk in "Scaling Git at OpenAI"

ylk — Tue, 03 Nov 2026 08:25:27 +0000

I guess by that account: somehow we managed without computers for millions of years. Get off the internet, please.

There are tons of different conditions people are in, with different histories of injuries, etc. and even people without any issues benefit massively from having a sensible, well structured workout plan that ensures their weaknesses are addressed and they work towards their personal goals. You don't need AI, an app or a personal trainer for that but while many people do enjoy learning a lot about exercising in their (often limited) free time, many don't and it's great if they have an affordable/free option. Why do you think physiotherapy exists?

Additionally, studies have proven that progressive overload is a really important aspect for progressing, so you should be tracking your workouts in some way, in an app or on paper, to ensure you really are challenging yourself.

New comment by ylk in "Today, we hacked what we'd set out to hack: the iPhone"

ylk — Sun, 25 Oct 2026 01:38:57 +0000

On which OS? Android and iOS don’t. Not even Qubes does.

New comment by ylk in "Today, we hacked what we'd set out to hack: the iPhone"

ylk — Sat, 24 Oct 2026 09:36:43 +0000

It's sandboxed, not in a VM but using the *OS sandbox/seatbelt. Running all renderers in a separate VM on a consumer phone sounds like a terrible time when you need to stay competitive regarding performance, responsiveness, etc.

New comment by ylk in "Passkeys are not a trap"

ylk — Wed, 14 Oct 2026 17:38:35 +0000

you can see in both the lastpassword and the bitwarden tutorials that the default iOS password manager can be toggled on or off, just like the other options.

New comment by ylk in "Passkeys are not a trap"

ylk — Wed, 14 Oct 2026 17:35:30 +0000

you're misunderstanding: this isn't specific to passkeys, this is for changing the password manager(s) used when filling passwords, 2fa codes and passkeys.

since the person I responded to couldn't find it, I linked tutorials. it amounts to opening the Settings app, going to "General" and then "AutoFill & Passwords", so it's also not terribly difficult to find compared to other iOS settings.

you could've at least tried to understand what's being talked about before blindly complaining.

New comment by ylk in "Passkeys are not a trap"

ylk — Wed, 14 Oct 2026 16:14:56 +0000

LastPass has a tutorial video that shows you how to only use them for autofill: https://www.lastpass.com/features/autofill/iphone

Other password managers do, too: https://bitwarden.com/help/auto-fill-ios/#keyboard-autofill

New comment by ylk in "Passkeys are not a trap"

ylk — Wed, 14 Oct 2026 16:07:59 +0000

This is not accurate. The very first sentence of that issue is:

> Passkeys should never be allowed to be exported in clear text.

and from another comment by the issue creator:

> I don't quite understand why requiring file protection/encryption can't be a temporary minimum bar here.

They're arguing for storing them in encrypted form. That's very much a different argument than arguing against exporting. I'm not taking any sides here, I just think it's bad to so badly misrepresent people's standpoints.

AI agents imperiled by critical vulnerability in open source package

ylk — Tue, 26 May 2026 21:34:29 +0000

Article URL: https://arstechnica.com/information-technology/2026/05/millions-of-ai-agents-imperiled-by-critical-vulnerability-in-open-source-package/

Comments URL: https://news.ycombinator.com/item?id=48286296

Points: 7

# Comments: 0

New comment by ylk in "BadHost – CVE-2026-48710: Starlette Host-Header Auth Bypass"

ylk — Tue, 26 May 2026 09:15:45 +0000

The URL was meant to be https://badhost.org, the site accidentally still has the old canonical meta tag.

BadHost – CVE-2026-48710: Starlette Host-Header Auth Bypass

ylk — Tue, 26 May 2026 09:07:18 +0000

https://arstechnica.com/information-technology/2026/05/milli...

Comments URL: https://news.ycombinator.com/item?id=48277107

Points: 126

# Comments: 51

New comment by ylk in "Microsoft Edge stores all passwords in memory in clear text, even when unused"

ylk — Tue, 05 May 2026 12:17:34 +0000

You're correct, thank you. Sadly I can't edit my comment anymore. Sorry for the confusion.

New comment by ylk in "Microsoft Edge stores all passwords in memory in clear text, even when unused"

ylk — Mon, 04 May 2026 21:08:06 +0000

There are (illegal) marketplaces initial access brokers sell session cookies on. Some companies try to defend against that by e.g. checking whether it's even possible that you travelled from place A to place B within a certain timeframe and, based on that, might invalidate your cookie. But then again attackers, depending on their sophistication, find their ways around it by ensuring they proxy their traffic via geographically close residential proxies, use the same OS and browser versions, etc.

Google now wants to bind credentials to a device by storing the secret in the TPM: https://blog.google/security/protecting-cookies-with-device-...

New comment by ylk in "Microsoft Edge stores all passwords in memory in clear text, even when unused"

ylk — Mon, 04 May 2026 20:05:23 +0000

For reference, this is how Google says Chrome stores passwords encrypted in memory and uses an elevated service to prevent other processes from impersonating Chrome and gaining access to the plain text passwords: https://security.googleblog.com/2024/07/improving-security-o...

New comment by ylk in "I found a vulnerability. they found a lawyer"

ylk — Fri, 20 Feb 2026 22:25:29 +0000

This is not how CVEs work at all. You can be pretty vague when registering it. In fact they’re usually annoyingly so and some companies are known for copy and pasting random text into the fields that completely lead you astray when trying to patch diff.

Additionally, MITRE doesn’t coordinate a release date with you. They can be slow to respond sometimes but in the end you just tell them to set the CVE to public at some date and they’ll do it. You’re also free to publish information on the vulnerability before MITRE assigned a CVE.

New comment by ylk in "GrapheneOS – Break Free from Google and Apple"

ylk — Tue, 17 Feb 2026 12:24:08 +0000

> The baseband can do a lot, it has dma

There's an IOMMU:

> Is the baseband isolated? > Yes, the baseband is isolated on all of the officially supported devices. Memory access is partitioned by the IOMMU and limited to internal memory and memory shared by the driver implementations. [...]

https://grapheneos.org/faq#baseband-isolation

> GrapheneOS cannot really influence this, but hardened_malloc could conceivably help.

They can and do, see above. But I don't see how hardened_malloc is related to the baseband doing DMA.

New comment by ylk in "RediShell: Critical remote code execution vulnerability in Redis"

ylk — Tue, 07 Oct 2025 09:20:16 +0000

fwiw, they're using CVSSv3. In CVSSv4, it's probably an 8.7: https://www.first.org/cvss/calculator/4-0#CVSS:4.0/AV:N/AC:L...

New comment by ylk in "Google: 'Your $1000 phone needs our permission to install apps now' [video]"

ylk — Sun, 31 Aug 2025 14:39:22 +0000

> Android 16 no longer provides device trees for Pixels as part of the Android Open Source Project. It's important to note it doesn't provide those for any other devices. There are no other OEMs providing similar AOSP support. [...]

by strcat, Graphene OS founder https://news.ycombinator.com/item?id=44679100

New comment by ylk in "Blurry rendering of games on Mac"

ylk — Fri, 15 Aug 2025 08:37:57 +0000

The screen is a 16:10 screen with some extra pixels added next to the notch. By default, the system uses a resolution of 1512x982 (14"), which you can change to 1512x945 (16:10) to move the menu bar below the notch and end up with black pixels next to the notch.

New comment by ylk in "Containerization is a Swift package for running Linux containers on macOS"

ylk — Tue, 10 Jun 2025 13:09:30 +0000

You don’t have to assume, the docs in the repo tell you that it does run a Linux kernel in each VM. It’s one container per VM.

New comment by ylk in "Quarkdown: A modern Markdown-based typesetting system"

ylk — Tue, 03 Jun 2025 18:43:01 +0000

Not trying to argue that this happens regularly, but some recent (last 6 months or so) minted update contained breaking changes.