Vehicle Data Sharing appears to be opt-out, not opt-in. They do say "If you’d like to ensure you’re not sharing data, check Vehicle Connectivity in your Settings menu in-vehicle and toggle it off." After doing that, someone should check to see if the wireless modem is still emitting.

[1] https://www.ford.com/data-and-privacy/manage-your-settings/c...

Second, how tough is this signal processing? Will it be done on-glasses, or through an app? Third, what's the equivalent of a wake word for these? I'm reminded of the Apple Vision Pro radar to see if your fingers are clicking. I could imagine a lot of modalities where I want to just start talking and have things happen, and a lot where I don't want the glasses to pick it up. Fourth, I think a cool voice change demo would be rad -- not sure what latency is like, but if you could get it end to end under like 250ms you could probably have someone exaggerate the mouth movements and pipe out audio of them talking like someone else. Which would be another really cool demo.

Super cool. You're going to be working 80 hour weeks for the next year, I'm excited to see what you put out!

I've found the opposite. Typing feels much more "deliberate", and of course you can hit backspace but you can't un-speak a word. With prompting, I've found that, in general, speaking leads to lower-quality results than typing.

Red Hat disagrees[0][1]. They might be parroting Anthropic, and Anthropic might be exagerating the impact (likely!), but that's the current consensus about the vulnerability. If Ubuntu disagrees, they should have said something and not pasted "Cvss 3 Severity Score 9.8 · Critical" at the top of the page.

> A motivated attacker could probably do this on your network

I find that's still catastrophic given how centralized cloud environments are.

[0] https://access.redhat.com/security/cve/cve-2026-98432

[1] https://access.redhat.com/security/vulnerabilities/RHSB-2026...

I took the lazy Mint route with my most recent machine since I wanted to use it for light gaming with minimal fuss. I'm going to redo it with Nix sometime soon because the value prop simply isn't there and I'd like to try a declaratively-configured distro.

And this is how Ubuntu describes the vulnerability to sysadmins:

  In the Linux kernel, the following vulnerability has been resolved:
  ipv4: free inet_opt and ireq_opt after an RCU grace period
  tcp_v4_syn_recv_sock() transfers ownership of ireq->ireq_opt to the
  child socket (newinet->inet_opt) without copying it.
  Another cpu can concurrently process a retransmitted SYN for the same
  request socket, and send a SYNACK from tcp_check_req().
  tcp_v4_send_synack() and inet_csk_route_req() read ireq->ireq_opt
  under rcu_read_lock() only, and ip_build_and_send_pkt() and
  ip_options_build() then read opt->optlen twice.
  Note that the SYNACK timer itself is not an issue: it holds a
  reference on its request socket, and inet_csk_reqsk_queue_drop()
  calls timer_delete_sync() before the child can be freed.
  Since commit 079096f103fa (“tcp/dccp: install syn_recv requests
  into ehash table”), request sockets are processed without holding
  the listener lock, so nothing prevents the child socket from being
  freed while the SYNACK is still being built. TCP child sockets do
  not have SOCK_RCU_FREE, and inet_sock_destruct() frees inet_opt
  with a plain kfree(), leading to a use-after-free in
  ip_options_build().
  A similar issue exists with request socket migration
  (net.ipv4.tcp_migrate_req=1, or a BPF_SK_REUSEPORT_SELECT_OR_MIGRATE
  program). reqsk_timer_handler() clones the request socket with
  inet_reqsk_clone(), so that the old request socket and its clone
  share the same ireq_opt, then reqsk_migrate_reset() clears the
  pointer in the old one. Another cpu holding a reference on the old
  request socket can still be using these options (sending a SYNACK,
  or creating a child in tcp_v4_syn_recv_sock()) when the clone is
  freed, and tcp_v4_reqsk_destructor() also uses a plain kfree().
  Readers already use RCU, and other paths replacing inet_opt
  (do_ip_setsockopt(), cipso_v4_sock_setattr()...) already use
  kfree_rcu(). Use kfree_rcu() in inet_sock_destruct() and
  tcp_v4_reqsk_destructor() as well.
  IPv6 is not affected by the first issue, because tcp_v6_syn_recv_sock()
  duplicates the options. tcp_v6_reqsk_destructor() has the same
  migration issue with ipv6_opt, which is only set by CALIPSO. This
  will be addressed in a separate patch.

Some of my clients may be surprised by this change, as I once advocated for Ubuntu as a good choice for a development and deployment platform. While that has not been true for quite a while, they have now jumped the shark into eel-infested waters; I cannot take them seriously any longer.

* https://launchpad.net/ubuntu/+source/linux

You can pull them down with a "-t" added to your apt-get (but will not appear by default).

26LTS had the new kernel go to the updates/security repos on October 28.

The post gives no details about what this vulnerability is, how critical it is, how it is impacting them personally, how vulnerable their servers are, how they are working around it.

Just a title designed to generate the maximum outrage followed by a few meaningless lines.

> Why is this CVE high priority?

> See ubuntu cvss score

That's it, we don't even get a period on this TBD of a sentence. It's followed by a generic link that explains what "Ubuntu Priority" is, but that page contradicts their choice. Note that it doesn't offer any mitigations either, and even the (horrendously unclear) description is copied from the NIST page, so there's no actual message from Ubuntu.

I already had a bad feeling the first time I saw "Get more security updates through Ubuntu Pro" on `apt upgrade`, this is now the kick I needed to move to a different distro.

[0] https://ubuntu.com/security/CVE-2026-98432#priority-reason

Surprised how many answers here are on "social" reasons, and ignoring that Ubuntu does provide genuine additions to Debian.

Ubuntu includes additional proprietary drivers to Debian. So there are legitimate hardware cases were Ubuntu will work out the box and Debian won't. I can't speak for how many people need those drivers, and how much of choice is down to defaults/inertia etc.

From hearing interviews with PopOS folk, I think this is also a big reason people choose Ubuntu as a base for a lot of Distros instead of Debian.

Canonical absolutely is marketing enterprise security updates (at least for those who pay). I don't see this in the paid ESM updates channel yet either?

I don't remember why exactly but it was definitely just 'linux VPS = Ubuntu' for a long time. I think they got reputation as being the 'just works' option because they were happier to include some non-free graphics drivers etc where Debian was the more pure option but most end users didn't care

But since they added snap and I started running into issues with trying to install Docker etc a few years ago I default to Debian now and most of the time I don't even know which it is.

I agree that the H1B train is a red herring but I explained in my comment how AI has enabled mediocre talent to become more effective. Effective enough where they are "good enough" for what most companies need.

One of the reasons why offshoring was difficult was that asynchronous work wasn't the normal, so what a lot of companies would do is give the uninteresting pieces to the offshored teams.

That's taken a 180 in 2026. Google, OpenAI, Meta are building core infrastructure and software out of India. They don't even have to pay H1B rates.

Tech was already moving towards asynchronous working, expedited post COVID but AI just exponentially accelerated asynchronous work. Bulk of the software in 2026 has been written, reviewed and tested by AI (whether the HN crowd likes it or agrees with the practice, or not). All asynchronously.

These two factors have come together where the average tech worker out of SF is not longer very valuable - companies are just hiring equally talented workers out of Austin or Vietnam, for way cheaper, assisted by token spend.

The highly skilled will continue to get hired but the median worker out of San Francisco is being replaced

Similarly, dismissing the concerns as "short sighted" is just ignorant of history. Plato was thinking about the challenges of reconciling immigration with democracy 2,000 years ago. Alexander Hamilton presaged the destabilizing effects of immigration on democracy at the inception of the U.S. https://www.iwp.edu/articles/2016/12/21/hamiltons-actual-vie...

Much of the coverage in Swedish media drives the point that only 4G-uplinked stores have been hit so far. I think that's unfortunate, because really it wouldn't have differed if these stores were connected by 5G.

I'm guessing here, but my money would be on freezer ICS systems being made available to the world by accident by way of NAT-PMP on a consumer router. In Scandinavia you can bypass CG-NAT on mobile connections by setting a particular APN, so my guess is that these control systems were simply findable on Shodan.

This also explains why this wasn't discovered after the recent French breach. Supposedly all the stores with "proper" uplinks were in compliance, and no one had thought of a way in for those non-compliant stores, because they "weren't even connected, so how would an attacker get in?"

The real issue is geniuses in food stores connecting to the open internet systems with 100K+ EUR of products exposed.

Remember, the 'S' in 'IoT' stands for Security.

> It will recalibrate your refrigerator's coolness setting so all your ice cream goes melty.

https://people.cs.rutgers.edu/~watrous/goodtimes-spoof.html

If virtually any other company in the world said "we have internal AI servers and we let our employees use them" ... the company would measure that as they would any other internal expenditure: by how much it costs them. You blow $50k a year on servers running your LLMs? It cost you $50k.

Only a company like Anthropic, desperate to make news and help their IPO, would measure by the cost they charge customers. It's as ridiculous as Microsoft counting every employee's use of MS Word ... as if it had paid the full consumer price of each copy.

Again the issue is not is Anthropic an amazing growth story. Zero would debate that.

The issue is this is a probably $200-300B company pretending it’s a $2T company.

Add to that the insane amount of committed spend, a high interest rate environment which means they’ll pay a painful premium to patch cashflow gaps, and a likely “junk” bond rating (per Friday’s news) and that’s why folks are concerned.

It’s also just wrong to keep dismissing the paper losses from convertible notes as somehow not real losses. Once they are a public company this will be actual value taken away from existing public shareholders so they are legit losses not to be ignored. It’s like claiming equity based comp is free money… it’s not, you’re taking it out of the pockets of shareholders.

Maybe they tried too hard to get good Q2 numbers, making revenue happen earlier and expenses later, and that now makes Q3 look worse? Either way, this does not look great

1. Mammals don't naturally exist in environments where exercise isn't mandatory. _Some_ system had to generate those compounds, and there was never any pressure to keep it from being tied to the other stress-related changes bones undergo (like density changes). Once it evolved once somewhere in some critter once via that machinery, the advantage was large enough that it was locked in.

2. Exercise directly contributes inflammatory factors. Tying the cure to those to a measure of exercise intensity (bone squishing) helps calibrate the dosage. Even if an imperfect measure, the proxy of bone loading might confer some advantage in, e.g., not wasting energy on unnecessary proteins.

3. Exercise indirectly suggests a resource-poor environment, leading to lower chance of offspring succeeding and needing longer lives to produce enough viable offspring. The compounds in question aren't free to produce, so there's an advantage in only providing them to organisms who will meaningfully benefit. Mind you, resource-poor environments often promote shorter lifespans and faster growth cycles as an evolutionary trait, _but_ without a mechanism to force your offspring to mature more quickly the osteocyte-mediated lifespan could allow for resource-dependent lifetime offspring counts.

4. The mechanism could have evolved for unrelated reasons, perhaps directly contributing to the bone density calibration osteocytes already mediate. Any impact on lifespan is incidental or otherwise produces less evolutionary pressure for or against the feature than the direct purpose of the compounds.

5. More than having evolved for unrelated reasons, the fact that the compounds have any effect at all might not be evolutionarily selected for. We produce plenty of unimportant metabolic byproducts that we don't particularly care about, and it could be that some more important osteocyte function incidentally produces these "waste" proteins.

Note, however, that their experimental model section says they applied axial force (think columns, not joists) to the tibia using an ElectroForce 3300 (https://www.tainstruments.com/3330-system/) while the mice were under anesthesia. From this, it seems like they knocked out the mice and placed their legs underneath a mechanical ram to apply axial compressive forces.

Because people are typically awake when exercising, given that muscles are designed to carry forces around the skeleton, I imagine, even after scaling from a mice to a human purely by sizing, the human force equivalent will be many times higher.

If you're looking to try this out for yourself, the seated leg press will most closely simulate the study's method. Figure out what "moderate" loading is for you, and shoot for 3 sets x 10 reps at least twice a week. Overall, choose skeletally-compressive exercises where you're "pushing," such as weighted squats (e.g. barbell squats) and any type of "press" exercise like the leg press, chest press, military press, and even cycling (you push your pedals). For the purposes of this study, avoid exercises with any pulling motion, including pull-ups, pull-downs, rows, and swimming.

From a force perspective, running has some compressive elements, but the load comes from gravity alone, and good runners minimize compressive forces. Since running therefore is primarily a pulling exercise, I can sort of see what they're getting at.

When I brought it home, I never connected it to Ethernet or WiFi. Instead, I connected it to my laptop over USB, then using adb I uninstalled almost every application from it. It took me quite some time to figure out what app is possible to remove and what should be kept to let TV functionality to work. I even had to factory-default it a couple of times because some random apps I removed were crucial for Android to work. :) I think it took me 5-6 hours to clean it. Now it has only basic TV functionality like any dump TV does, I can watch air and cable TV channels, watch movies and play music from USB storage. If there's a need to watch something online, I connect it over HDMI to my small mini-PC that runs FreeBSD. I think I'm satisfied with the result. :-)

PS: Yesterday I opened the case and disconnected WiFi antenna. Just in case.

Second, never use the "apps" built into the TV.

Next, don't plug Ethernet into the TV. Plug HDMI cables into the TV.

Use a box of your choice on the other end of the HDMI cables. This is now the box that you trust. (Roku? Shield? Blu-ray? MacBook? PC? Linux? Playstation? XBox? Whatever you want.)

The Smart TV itself is now fine. Choose the devices you plug into it to play content. The TV just shows it.

Yeah they do. Go to your shopping center or airport and you'll see LG and Samsung displays everywhere. And that's the key word, 'displays' not 'TVs'.

Both sell large displays meant for 100% user ownership with no spyware or mandatory internet connection, you just have to buy those and not their TVs.

The catch? They come at steep prices compared to consumer TVs, unless you can land a deal on the used market. But that's the cost of turning a profit on screens with no spyware and ads.

Iirc, Amazon uses a tool they call “sidewalk” for this purpose

I have a BenQ (710tki iirc) that is like this and I believe it meets all your stated requirements (size, resolution, etc). I’ve been very happy with it.

This makes it evident how this strategy exists to maintain the "magic" and fool the masses. It has no place in a progressive society where being duped with propaganda into believing falsehoods should not be something to look up to.

I think fiction books are more important and more "wholesome" than nonfiction ones.

Also... "Each book links back to the comments that mentioned it."

> Please don't put generated text in HN posts.

Claude speak gives me a gag reflex these days.

The only "third-party" packages that we want to ideally allow/support would be provided from LTS versions of our runtime (in this case, packages provided by the dotnet team and audited by microsoft). So we will always try to build around what the framework provides. Second choice is our own code, third choice is open-source packages, fouth choice is a separate application/appliance (lets say ZenDesk for ticketing). Over time, we will reduce this footprint to only have dotnet team code and our own.

Remember most CVE's can be hidden on servers that are not publicly routable and don't have a real exploitation paths. The bits that are public (lets say a linux edge server with a web server on it, some firewalls, a couple of open ports) - these should be hardened to the max and not allow full access to all the services running behind it. We don't even give our internal services public IP addresses to make near impossible to route traffic to them.

Our git repo's are also not on public infrastructure (serious, think carefully about hosting on public services and if you really need it), never mind making the repo public.

We also have a dedicated secrets/certs manager, so no credentials are in codebases or pipelines. Very strict in this regard.

> That's a lot of work, but is it productive in the end? Probably not.

Your imaginary scenario defines the solution to be pointless. If that same city was subjected to weekly riots smashing windows & doors, and people regularly died, stopping "productive" work to install things that keep people alive and productive? That's productive.

And half the software products are worse than that.

Any organisation that said "let's move fast and break things" is now busy finding out what's actually broken.

This seems…good?

That it might disrupt the project's "traditional" release cadence a bit doesn't seem terribly bad in light of the alternative, which is shipping another major update with bugs which have apparently haunted the codebase for some time.

Gamedevs can make better games with AI! Yet the creatives don't get into gamedev if they didn't have to spend any effort to make their art

Mathematicians can advance mathematics with AI! Yet mathematicians don't get into mathematics because they want to "advance" mathematics

Teachers can teach better with AI, writers can write better with AI.. Can they?

Can't you people understand romance and the beauty of the human endeavor

Which is absurd on it's face for most day to day programmers, but a critical distinction for theoretical computer scientists.