https://marginalia-search.com/

Is good for finding human written work

I wonder if Edam is a big factor here

Here it is again! 153 votes, double the nearest competitor:

https://community.home-assistant.io/t/wth-cant-i-control-what-other-users-can-access-rbac/1030886

Didn’t know this:

Shallow clones are awful. Run your own damn mirror if you’re going to do something nasty like that.

Shallow is the default/recommended in a lot of places though apparently:

Shallow wins the clone, every time, by 4-6x. Which is exactly why actions/checkout defaults to depth=1, why GitLab CI ships GIT_DEPTH=20, and why Vercel hard-codes --depth=2 with no way to change it.

https://bex.co/blog/2026/08/08/git-push-paas-shallow-vs-partial-clone-build-checkout

Separately, one source of the scraping:

welcome to the wonderful world of “proxy SDK monetization.” It’s big business, and your TV is probably doing it.

The link in the article is useful, https://spur.us/blog/smart-tv-apps-residential-proxy-sdks

Amazon makes it explicit: its Device and System Abuse Policy prohibits apps that facilitate proxy services for third parties. Roku has reportedly shut the door too: Lowpass, syndicated at The Verge, reported that Roku bars developers from using Bright SDK and similar proxy services, and that Roku apps using the SDK disappeared after the company was contacted.

LG and Samsung have not drawn an equivalent public line. That is the gap these apps are living in. The same business model that Amazon bans and Roku reportedly blocks is still showing up at scale on webOS and Tizen.

It concludes:

A TV app should not be able to quietly turn a living-room device into residential proxy infrastructure. Screensavers, games, clocks, and novelty apps can be boring, cheap, or ad-supported. If an app is going to monetize a household’s internet connection, the user should be clearly informed about what that means, how the connection will be used, and what risks and tradeoffs they are accepting.

We need to help everyone in the world block their TVs from doing this, this is such an abuse of trust.

This one stood out to me in the direct, looked interesting.

They didn’t move fast enough on it and others began circulating it. So they had to play catch up, hence the need to react before they had a patch.

We won’t pretend otherwise: the delay was a structural failure, caused by both the security team’s decision process and its lack of resources. The security team has since started changing its processes, and that work continues, so that decisions can be made by majority and compromises are encouraged.

https://thephp.foundation/blog/2026/10/21/todays-php-security-release-and-how-were-strengthening-php-security/

It seems the manifesto was quite artfully written to allow an interpretation where this is not a broken promise:

Page 52 of Labour’s manifesto reads like a rhetorical twister – a paragraph of promises seeking to stretch in multiple directions at the same time, trying to keep a breadth of people happy simultaneously, or perhaps not annoy too many people too much.

“Labour will not revoke existing licences and we will partner with business and workers to manage our existing fields for the entirety of their lifespan. Crucially, oil and gas production in the North Sea will be with us for decades to come, and the North Sea will be managed in a way that does not jeopardise jobs,” it reads.

“And our offshore workers will lead the world in the industries of the future. We will not issue new licences to explore new fields because they will not take a penny off bills, cannot make us energy secure, and will only accelerate the worsening climate crisis,” it adds.

BBC News - Chris Mason: Jackdaw approved but tricky energy trade-offs remain - BBC News https://www.bbc.co.uk/news/articles/cked35dz47y7o

Along those lines and more besides is a good little book:

https://openlibrary.org/works/OL26660798W/How_to_Keep_House_While_Drowning

What do you do with the bags you’re not going to get to for a few weeks, is freezing the best thing?

I do not run Immich but their privacy policy states:

Locally Stored Data: Immich stores all your photos, albums, settings, and other metadata locally on your device. We do not have access to this data, nor do we transmit or store it on any of our servers.

https://immich.app/privacy-policy

Additionally in their docs I can find no mention of connecting to outside services. I do see references to downloading hugging face models.

https://docs.immich.app/features/facial-recognition#how-face-detection-works

Potentially the server can request hardware/software attestation that would limit the choice of password safe to approved ones only. We don’t yet know how big/likely this could be, but in theory it’s possible.

This is what people seem to be missing, I haven’t seen a rebuttal to this problem.

I agree 100%, this post is not a full rebuttal and does not tackle the concerns directly:

• The character of the organisations in FIDO does not inspire confidence against lock-in or monopolistic behaviour
• The possibility of future attestation cutting out those on ‘unapproved’ software and hardware.

I agree parts of the tech are good, particularly the anti-phishing, anti-replay measures.

This post seems to say passkeys are in good hands so nothing can go wrong, but I don’t think that’s enough.

Maybe one extra thing you are missing is passkeys are resistant (not proof) to phishing. The user returns an ‘assertion’ that:

uses the private key to digitally sign a challenge value from the server, together with contextual information such as the requesting origin

https://developer.mozilla.org/en-US/docs/Web/Security/Authentication/Passkeys

It useless to pretend to be the bank as you’ll get an assertion from the user you can’t replay and the user’s passkey implementation should spot the origin is wrong and refuse to sign it anyway (as I understand it).

Maybe more ethical choices will come. In the meantime we can reduce harm today and incentivise those building the hammers if we choose the ethical ones now.

Say that metal on a stick was made from a rare metal that can only be sourced by mining the land of a threatened indigeneous tribe. If I use or buy that tool am I really neutral, even if I build hospitals with it?