Looks like it checks for the referrer in main.js and adds the uppercase text-transform if you come from HN:

  let host;
  if (document.referrer) { host = (new URL(document.referrer)).host; }
  if (host === "news.ycombinator.com" || host === "lobste.rs") {
    let style = document.createElement('style');
    // let transform = host === "lobste.rs" ? 
    style.textContent = `
      body { text-transform: uppercase; }
      pre, code { text-transform: none; }
    `;
    document.head.appendChild(style);
    console.log("HN readers clearly can't handle the typing habits of the average trans girl.");
    return;
  }

Sounds like the author got called out for not capitalizing the start of her sentences[1] and decided that, if HN readers want capital letters, they will get them.

[1] https://news.ycombinator.com/item?id=39027187

Which is funny because if you engage Reader Mode in the browser, everything becomes proper except sentences, which still start with lowercased letters for some reason. Names are still properly capitalized. It's truly bizarre

It's a less... dramatic... version of what happens when HN links to JWZ's blog.

But where's the testicle in an egg cup?

It seems the suggested solution is to use server credentials that lack delete permissions (and use credentials that have delete for compacting the repo), but does that protect against a compromised client simply overriding files without deleting them?

no-delete disallows any kind of deleting information, that includes object deletion and object overwriting.

No. Delete and overwrite are different. You need overwrite protection in addition to delete protection. The solution will vary depending on the storage system and the use case. (The comment in the PR is not an exhaustive description of potential solutions)

Append-only would imply yes. There is no overwriting in append-only. There is only truncate and append.

You have misread I think.

There used to be append-only, they've removed it and suggest using a credential that has no 'delete' permission. The question asked here is whether this would protect against data being overwritten instead of deleted.

Yes, it also disallows overwriting.

Yes, its called "hybrid transport", and its a flow where a laptop presents a QR code to a mobile phone, who then sets up a BLE connection for one time use of the passkey.

https://www.corbado.com/blog/webauthn-passkey-qr-code

(Not sure how the "cloud assisted" part of caBLE works)

So... you need to carry two electronic devices for this so-called security solution?

No… you can also sync with iCloud Passwords, or use a hardware token, like a Yubikey.

So a Yubikey is not an electronic device that you need to carry?

iCloud Passwords don't run on an iPhone that is an electronic device that you need to carry?

Those electronic devices that you mention don't each store the keys in a proprietary format and you can't access them without the vendor's cooperation - i.e. vendor lock in?

>Those electronic devices that you mention don't each store the keys in a proprietary format and you can't access them without the vendor's cooperation - i.e. vendor lock in?

Passkey portability is being worked on. Here is the draft of the open standard:

https://github.com/fido-alliance/credential-exchange-feedbac...

News article: https://www.theverge.com/2024/10/15/24270875/password-manage...

BLE seems to be a different way to authenticate than QR codes. Desktop computers may often not have Bluetooth chips.

Note that this requires native iCloud support on the host machine, so macOS or the iCloud app on Windows (no Linux support)

I'm hearing mixed information about whether this even works on Windows (I've been told the Firefox version of the extension only works for macOS, not sure how correct this is).

> no Linux support

Yeah, that makes it useless to me.

Does anyone have insight into why Apple encrypts SEP firmware? Clearly it’s not critical to their security model so maybe just for IP protection?

They have a long history of encrypting firmware. iBoot just stopped being decrypted recently with the launch of PCC, and prior to iOS 10 the kernel was encrypted too.

The operating theory is that higher management at Apple sees this as a layer of protection. However, word on the street is that members of actual security teams at Apple want it to be unencrypted for the sake of research/openness.

Someone high up is an idiot presumably

Notably, only the pro models support USB 3. The base 16/16 plus are still on USB 2. This hasn't changed from the 15 lineup when they switched to USB-C.

what do you use that usb 3 speeds matter? The only thing ever plugged into my phones port is a charger.

I have a bad wired internet connection and use my phone to download anything over 1gb. takes 2 minutes instead of 2 hours.

also use it as a portable usb stick. when you are transfering stuff over 10gb, usb 3 is very very usefull.

Wouldn’t it be easier to simply fix your ethernet wiring (or just use wifi) than to sneakernet large files using your phone?

No it's the internet connection, 1gb takes two hour to download in perfect condition. Not complaining tho. There are many part of the world where you rely on your phone for internet and to download stuff and then use the computer for excel or to watch movies you downloaded.

if they can only get eg DSL at their location, how would they fix that?

They said that the iPhone can record video directly to external storage, so you would need the faster USB speed for that. Quite a nice feature for productions which use the iPhone for professional video.

Same thing you use prores log video for.

May be worth noting that ProRes is entirely unrelated to “Pro” phones (and predates them by over a decade if I read correctly.)

Could this end up on an embedded smart tv device, like a Roku?

They have an android receiver package available: https://gitlab.futo.org/videostreaming/fcast/-/tree/master/r...

FCast engineer here. Yes it will come to Roku.

dupe: https://news.ycombinator.com/item?id=39778999

What extensions are you using for C# on code-server? AFAIK the official C# extensions from Microsoft (C# base and dev kit) aren’t licensed for non-vscode use.

Well, I think I'm doing the dumbest thing possible, which is just running code-server with not many extensions...

I'm using code-server as a dumb text editor, akin to using notepad.exe back in the day.

But I'm honestly very comfortable with that. Especially for the kind of code I'm writing.

IIRC TextEdit.app has options like smart quotes, auto capitalize, and spell check turned on (in addition to being rich text by default), so you have to change all those to be a dumb plain text editor.

TextEdit and the Notes app have both caused me to copy/paste the specialized quotation marks.

Now I only use vim as a scratchpad because I've been bitten too much by GUI apps