skysight-inc/HackerNews huggingface dataset:
I can’t quite figure this out: it sounds like if you click a link in someone’s TikTok content, the in app browser can read any text entered on that site using the in app browser. Does just not entering any keyboard input in the in app browser mitigate this?

Does Apple Lockdown help in this situation? I thought that typical TikTok use just involved scrolling and watching video content. Are users who only view content subject to this security flaw?

Thanks in advance for any clarification.

Also, off topic but doesn’t YouTube’s “Shorts” take the place of TikTok? I have my Google privacy settings set so YouTube can store my viewing history for one month so I get reasonable recommendations. Does TikTok have similar settings?
Teflon is certainly a perfluoroalkyl substance but it is perfectly safe as long as you aren't thermally decomposing it at temperatures that are too hot to cook at.
It would be nice if more of the burden of proof were on subjective systems that historically have been full of racial bias, rather than on the communities that have historically suffered from the effects of the discrimination.

This is not an isolated incident, there are dozens of lawsuits and the study from the Brookings institute linked elsewhere in this thread.
To be fair, Facebook and Instagram were caught first, and the news got to the front page last week.
Just use a little butter, olive oil, or lard (bacon is good) whenever you cook with them.
The same household chemicals (especially at 120 degrees C) would kill all life. They are effectively forever in the environment.
> at least for now

Yep, the aarch64-nintendo-switch-freestanding target will (very likely) be available in Rust 1.64.0 [0].

[0]: https://github.com/rust-lang/rust/pull/88991#issuecomment-11...
Condolences. Had you had them long?
How Pepsi Briefly Became the 6th Largest Military in the World
I've felt like this for a very long time, and it's disappointing that there aren't really any tools to do this yet. It would make it so much faster to come up to speed on a new codebase, and also to see where some potential problems might lie.
> despite feature phones normally having very long battery time, this is probably not the case when using personal hotspot

if you don't mind USB tethering, i'll bet that's a lot more power friendly (and if the feature phone still drains fast, lets you keep it powered for as long as you need the hotspot). i think most "feature phones" nowadays run Android -- which should support USB tethering though possibly conditional on your carrier if you don't root it first.
No. All you have to do to use Replicache is embed the `replicache` npm package in your client-side code, and implement the expected REST interface on your server: https://doc.replicache.dev/guide/intro
You probably know what you are talking about but the lack of research doesn't fill me with confidence [1]:

> However, at temperatures above 500°F (260°C), Teflon coatings on nonstick cookware start to break down, releasing toxic chemicals into the air. [...] Polymer fume fever consists of temporary, flu-like symptoms such as chills, fever, headache, and body aches. The onset occurs after 4–10 hours of exposure, and the condition usually resolves within 12–48 hours.

[1] https://www.healthline.com/nutrition/nonstick-cookware-safet...
Why the hell was this flagged? What? God forbid someone posts a great blog article with good photos about a person visiting a rally for a group often discussed disdainfully on this very website and demonstrates that they're not all monsters or redneck idiots.
No not all of them do this. Yes, Instagram does, as per the chart in the article. The difference is Tiktok forces you to use their in app web view, and does not allow you to use your default browser, where they would not be able to inject their own JS code. Even worse, Tiktok monitors every single key stroke, a key logger in effect, where Instagram does not (according to the authors research).
> by hiding them among good faith arguments

It is literally in the HN rules that you are supposed to assume good faith, not concoct false attributions of intent and conspiracy. I did not intend to hide anything, I was earnestly asking a question (clearly shared by plenty others in this post). It should not upset you this much. I apologize for anything triggering to you that I said, that wasn't my intent.

https://news.ycombinator.com/newsguidelines.html
There were governments when those rules were formulated. Unless you mean, "Older than all governments in existence today," which might be true.
I dont get the sense that the "dont tread on me" folk are interested in balanced or nuanced opions about what constitutes treading. It's modern resurgency seemed clearly stemmed in an anti-any-government tea-partyism, seems like a rejectionist Thatcheristic "there is no such thing as society" view. It's insulting, gross & incredibly hostile naivety to many to treat our union as bad, to practice deliberately against it.
> why can [XXX] nationals buy housing here, while I can't do so there?

Simply because when XXX nationals come with all cash offers and willing to pay above market & waive all contingencies, sellers are willing to sell.

It just so happens that certain nationals are more prone to having that sort of money than others.
>> Does just not entering any keyboard input in the in app browser mitigate this?

yes but i doubt the hundreds of millions of users, many of which are children, know this
FreeBSD handbook is also very, very good. I think that the BSD's are each more or less self-contained has something to do with it. You can read everything about system services, for example, in the handbook without having to chase down systemd blog posts and compensate for various differences between versions and distros.
it's the ones who are not the most overtly monstrous or redneck idiots you need to watch out for, who'll work behind the scenes to do things like put christian fundamentalists on the supreme court.
If its super well seasoned it won't rust even with soaking for two days in dish soap.
It's true that those temperatures are too hot to cook at, but overheated oil at 260 or 270 degrees is a great deal more conspicuous than teflon pyrolysis at those temperatures. This makes the overheated oil safer, in the same way that silane is safer than hydrogen sulfide even though its lethal dose is lower.

Still, I like cooking on teflon.
By the definition of early investors, it already is. a16z is an early investor in this new venture, expecting at least a similar sized outcome.
They do a lot more than that.

> TikTok iOS subscribes to every tap on any button, link, image or other component on websites rendered inside the TikTok app.

> TikTok iOS uses a JavaScript function to get details about the element the user clicked on, like an image (document.elementFromPoint)

And that's just a sample of the calls the author was able to find.
We rebuilt solo v2 [1] firmware in rust, compared to v1 in C [2]. I haven't written any rust code so take what I say with a grain of salt, but generally speaking I think our experience has been very positive.

Rust forced us to structure the code a bit better, that makes it easier for multiple people to collaborate on it. Slightly harder learning curve, but that wasn't an issue in our case.

In the history of solo, we had a couple security bugs that rust would probably have prevented, so this is a plus for the language. Moreover, the cryptography community is pretty active and we can leverage solid + well maintained libraries.

One downside has been collaboration with other OS projects. When we had the C firmware and fido2 library, in less than 1 year we've got 3 other products embedding our code and also a couple manufacturers making demos with it -- a great win. With rust to my knowledge we're not there yet, but of course we're very positive.

[1] https://github.com/solokeys/solo2

[2] https://github.com/solokeys/solo1
I would zoom out a bit.

For example, when the media in The West "front pages" the smog in Beijing keep in mind The West owns a good part of that. It's not like what's manufactured in China stays in China. I would presume their water ways are nasty as well.

Just one example mind you. The point is, there are other imbalances. That's not to say TikTok should get a free pass, only that it's complicated than an app for app comparison.
To you, but to muscle crowd stupid noise is essential.
Digi-Key Innovation Handbook
"TikTok subscribes to all keyboard inputs (including passwords, credit card information, etc.) and every tap on the screen, like which buttons and links you click."

How does Apple even remotely allow this?

They ban apps for the most arbitrary of reasons, I know small devs that get bumped for tiny things.

This is beyond ridiculous.

A company that has ~100M american users, and CCP on the board with a CEO/Board completely and publicly compliant with the 'wishes of the CCP' including reporting any and all sorts of things, is literally able to collect any data including passwords.

WTF.

How is this not a giant story?

How does the US Government not issue an immediate statement/warning to the general public and talk to Apple/Google about this issue?

My gosh.
> The best advice to sidestep phishing scams is to avoid clicking on links that arrive unbidden in emails, text messages and other mediums.

Also, phone numbers. My dad (in his 50s and pretty tech savvy) recently received one of these and then called PayPal. Their CS people started asking for remote access to his computer (so they could see how he'd been hacked), which thankfully set off alarm bells big time and he hung up.

He swore up and down that he'd looked up PayPal's number online, that he'd never call a number that arrived in an email, but when we looked at his phone history he'd definitely called the number the scammers had sent.

This was pretty sobering for me. He was 100% sure he wouldn't call a number that arrived in an email. He knew it was the wrong thing to do. But in the panic surrounding the alleged fraudulent charge, he'd forgotten and just called the first number he saw. I like to think I wouldn't do the same, but when it comes right down to it I can't be sure.
Thank you for the paragraphs, sir.

I still don't agree with your point fundamentally, but I appreciate your work immensely, and that is far more important.
Gross attempt at a viral ad. Do not click.
I don’t think it would actually be nice if the burden of proof rested on the accused. This example isn’t a study of systemic bias, and is both individually and statistically meaningless.

It would be nice, however, if the paper of record didn’t call out a home appraiser, by name, in front of a national audience, with no evidence, as being a racist.
>I promptly canceled my Prime membership, not for the money but for not rewarding dark pattern behaviors.

Lucky you who was able to get through the dark patterns in the unsubscribe page. I got one extra charge because the first time I tried, I fell for one of their dark patterns and believed it was canceled while it wasn't.
I appreciate your thoughtful response. I think that Chinese apps should at least be held to the same standards, as they are there, and I think it's reasonable to assume that they currently aren't.

The thing is, and I don't believe this to be controversial, that China has built a digital database of all (or most) of its citizens based on the data they collected. Now the question is, do they stop there, or do they have a file on all of us? The technology is cheap, and I think based on video data etc that they collect through apps like this, they might well build a social graph of the rest of the world (i.e. who does exist, what are their interests/beliefs/political affiliations, and what are the relations between those entities.)

The repercussions of using such apps might be, that they have info on citizens in the rest of the world, which might allow them to nudge people into giving into their political goals (this has already been happening after people posted stuff critical of China on sites like Twitter) - and I think that we have to ask ourselves how that could threaten our democracy.
> All of which can be done without a blockchain

Yea but it hasn't though, so maybe the incentive models a blockchain-based approach provides is what actually makes this practical, consider that.

> without the massive environmental damage

That's a silly argument, but regardless the chain all these projects are built on (Ethereum) is about to move to Proof of Stake in a month, which makes it's carbon footprint nothing.
Nothing in my comment prescribes who or what you should pay attention to.

First you’re bothered by what networks are covering. Then I explain why these topics may be interesting. So then you say I’m backwards because I shouldn’t pay attention to what they are covering. Good grief: why are you bothering to complain about what they’re covering in the first place? Isn’t your first comment backwards for the exact same reason?
A good doc on the subject, reminds one of the tobacco industry a bit earlier:

https://en.wikipedia.org/wiki/Sugar_Coated
Chinese companies are not categorically banned. Huawei had to do more than be Chinese.
Bill Gates’ nuclear startup wins $750M, loses sole fuel source
Kudos on this! It's really nicely done and works well.
Create Colormaps from Images
Quickly create matplotlib colormaps from images.
Indeed. By the post title I hoped to see link to something like Ferris Sweep github page with open source PCB and QMK/ZMK configuration.

I was disappointed that traction was gained by (subjectively) horrible row-stagger layout on a non-split board without extensive configuration capabilities.

Regarding lowprokb's corne it is worth mentioning that $320 for board is a lot in a low profile community. If one capable of soldering board by themself you can get pretty much any layout under $150 (for USB version, BLE MCUs are a little more expensive).

Price list would look something like this (shipping included):

- $20: x2 ProMicro (type C version exists on Aliexpress) microcontroller

- $50: x5 JLCPCB PCB print (you cannot order less than 5 PCBs so you'll have spare parts)

- $30: x50 Kailh low profile switch (you might need less that that)

- $50: x50 MBK low profile keycaps

-~$150: Total, excluding soldering iron and consumables.

Often low profile boards are caseless, meaning that PCB is open[0].

[0]: https://ik.imagekit.io/dkptz7znccj/wp-content/uploads/2022/0...
Well then your tastes fall into the cheapo mass produced prints at Target category for movies and books. Some people do care about the provenance of a film, and watch any movie that comes out from a director they fawn over, for example.
Just when google was starting to be useful again as a reliable indicator of pages you don't want to go to.
This was expected and the intention for this invasive spyware is obvious, otherwise, how else is their dystopian recommendation algorithm supposed to work if you don't give access to your entire life records.

The difference is that this was done before by Meta / Facebook and they were fined in the millions, and even by billions by regulators like the FTC over this. This same problems a decade ago are being repeated once again and we have learned nothing.

TikTok should be under the same regulations, especially when they are operating in many countries that have strict data privacy laws and given this unsurprising and extremely invasive data collection practice which is even worse than Facebook, they should be fined in the billions of dollars as a reminder that it applies to any social network, especially those with billions of users.

If left alone, it will only get worse for everyone.
Who ever still using tiktok is surrender their humanity:

Fed manufactured content with artificial mental stimulus

Privacy got infringed in every second
The first amendment applies to US law and the rights of US residents, not to foreign multinationals. The USA can and does restrict the speech of non-Americans in America, such as with respect to political campaign funding.

Plus, criminal speech can be restricted in any case. If it's determined that the TikTok app is violating the law or facilitating the commission of criminal activity, the distribution of that app could itself be deemed a crime, or even worse for app stores, subject them to civil liability.
I really appreciate you making the effort to debunk the witch-burners; have you thought about doing it in a less ephemeral medium? Your comment will probably be here for a decade or more but nobody will read it after this month.
I used to agree, until I found out about Alaska Airlines Flight 261. I'm not sure what fail-safes are built into current Boeing and Airbus planes, but having the horizontal stabilizers malfunction is my new worst case scenario when flying now.
Also though,

On-Topic: Anything that good hackers would find interesting.

This isnt just politics. This is a nuanced & complex view of the world. This is anthropoly that happens to involve poltitics.

The anti-anything-at-all-political bias is way out of control, utterly unchecked, and absurd. [Ed: Im ok with this particular flagging, but it makes me so sad that some of the biggest & widest & most impactful parts of our world are off limits to discussion.]
Yes, that really what I meant. Once you’re on Facebook it takes over your reading selection, and it does so to the benefit of Facebook.

It’s been incredibly pernicious, and I remain astounded that we (Facebook users) allowed it to happen.
The Future Could Be Blissful–If Humans Don’t Go Extinct First
Agreed with most comments here, the implementation is leaky as heck. It’s a ‘best efforts’ VPN service at best and you can tell this especially when in a mall and there’s a walled garden in place. I use iVPN and regularly have to disable wireguard to pass the walled garden to then also regenerate a certificate. Enabling VPN through the iVPN app is hit and miss, likely because Apple have decided to do their own thing and implement ‘Private relay’ instead.

Yeh… Apple, Five Eyes, Privacy is all pretty much an illusion when you have this many devices in this many pockets.
Whatever it is, vpn’s or end to end encryption, it’s all really only as secure as the touch screen controller telemetry logs.
No, it's even more awful. I was visiting my mother and little sister (tween at the time) on vacation from work (we lived in different states), and I was going to make them breakfast. Spaced out on the pan while trying to sort out the ingredients. Everybody tried to make me feel better (because no one else had ever heard that Teflon kills birds either), but little sister was distraught.
These same tools are what allow you to build and ship fully JS based apps on iOS instead of having to use Swift or Objective-C or anything like that. Arbitrary web views can be an entire app. Or they can reinvent the wheel and become in-app browsers. A lot of apps are fully or partially web based. Even Apple’s own apps use web views in crazy ways. For example, the entire Mac App Store used to be a web view. Parts of macOS system preferences are web views. It’s just that because they’re web views, if you slap browser-like chrome on them and send them to the internet, they also work as web browsers.
yeah, I find software engineers like to find absolute answers to fuzzy problems. I guess it's the nature of the job
While it might be difficult to initially leave Facebook, I find it's easy to remain gone once you do. The FOMO disappears slowly, your contacts learn the better ways to contact you, you re-learn how to interact with society through the free web, over the phone, and in-person. While painful, it will eventually dawn on you that those people who won't interact with you anymore simply because you're off Facebook: They aren't really your friends. And those businesses and events that can only be found via Facebook: They aren't worth it.

This is controversial and I always get shot to hell for saying it, but they really aren't worth it. Businesses, friends, even family. If they really require you to use Facebook to talk to them, they don't deserve to be in your life.

After almost a decade off the platform, I still firmly believe that there is no real value there, it's an illusion. It's all held together with FOMO and fear of loss. And you can quite easily lead a fulfilling, happy life without being a part of it.
Political discussions without any "tech" aspect to them routinely get flagged here.
My gas hob burns at >450C and we’ve had several instances of a forgotten teflon pan that made a terrible smell.

I’d say it’s pretty easy to get teflon to degrade at home.
There's also a trend of kidnaping people in Brazil to force them to execute PIX transactions using their phones. It hasn't been exactly smooth sailing.
If the news is to be believed, housing supply is limited in the US.

US Housing is generally a safe investment for foreign investors. Since US vestigial racist policies make it difficult to create dense, affordable housing, single family homes are in high demand and relatively limited supply.
I'm so sorry. I'm a fan of teflon but I'm spacey enough that I wouldn't cook on it if I had birds.

How long ago was this? I'm guessing that the relevant knowledge maybe still isn't widespread.
Apple exposes two ways to use an in app browser. One is a legacy method that gives you full control, the other gives the user a sandboxed browser with no interference from the app.

TikTok isn't the only app abusing this. Instagram and Facebook will both do sneaky things like respond to the content of the page you're browsing (asking to save passwords in their own private keychain, showing context specific information, etc.)

-

You're not exposed to any of these if you don't open a link inside the in-app browser.

The most common reason to click a link in their in-app browser is an ad... so obviously TikTok, Instagram and Facebook are using the in-app browser to track your interactions after the ad click and sell the data
Very nice, and thanks for sharing!
isn't that what txt coverage is about?
Interesting, I'd heard that those saturated fats basically can't be oxidatively cross-linked to form a seasoning?
Proposal withdrawn for JavaScript Function.pipe / flow
Is this still common? I think AP recently moved away from subtracting points for incorrect answers.
Not sure what you'd have to plug to Pinephone Pro to destroy anything. Maybe a badly broken charger or a dirty plug.

There's nothing wrong about Pinehnone Pro's Type-C port supporting circuitry. It's pretty much a reference design this time.
We considered removing the prompt, but I've found that it's interesting to intellectually know what to do with a familiar action, but be unable to do it to some small degree.

The reaction difference would theoretically be amplified over time, and if you were to take the test for 30+ minutes a few times a week, the impact would (again, theoretically) be greater.
I think you can still buy an iPhone in China, but the only Apple services that appear to be available are the App Store (some apps such as VPN apps and news apps are obviously unavailable) and Apple Music.
It is, now. NextJS, Gatsby, Remix, Astro, Deno's Fresh are all frameworks that prioritize server side rendering in the server-Javascript world, rather than client side single page apps from a few years ago.
No, AFAIK not on android.
As it uses the default browser, just in webview mode.
Apple and Google have guidelines about what apps are/aren't allowed to if they want to be on their app store.

"Protecting the user" is supposed to be one reasons they take a 30% cut of all in app purchases. Apple even uses this as an excuse to not allow side loading apps.

How are they not blocking this?
Right, it’s only an appraisal, but mortgages are dependent on appraisals so you’d expect it to push the actual selling price down.
$11.6k 3D monitor requires PC – no need for headset
Instagram and Facebook do the same thing.
No, it isn't about people being more prone to buy property in one place, rather than another. Let x be a any number in [0, infty), I literally can not buy property in China for any x.
I Once Was a Free-Hand Coder
Thank you for sharing your idea with us :-)