Feed aggregator

Article URL: https://busy.app/

Comments URL: https://news.ycombinator.com/item?id=48932341

Points: 1

# Comments: 1

Article URL: https://blog.frankrousseau.fr/15-years-of-free-software-projects-a-review/

Comments URL: https://news.ycombinator.com/item?id=48932317

Points: 2

# Comments: 0

Hey HN,

Something I've been tinkering with in the background is a system to manage the "messy-middle" of TypeScript toolchains. Quite often, when I'm using Biome or any of the other linter / formatters, there will be repo conventions that I want to enforce (especially with AI agents), but which aren't supported by them, such as:

- Enforcing lines-of-code limits in modules - Never using custom TailWind colors - Only using lowercase underscores in filenames

Like, this is quite "random" but also bread-and-butter stuff that it's easy to think or talk about when you're working by yourself or with a few other human teammates, but I've found that agents consistently miss these conventions if I put them in an AGENTS.md file for example.

I wanted to make my esoteric repo conventions less stochastic, and more deterministic. I realised that agents are adept at writing the kind of code needed to run arbitrary checks on the TypeScript AST or workspace environment -- the kind of code that is cumbersome to write as a human.

So, I've made Pokayoke (https://pokayoke.codes) and would like your feedback! It's a small library that gives agents a place to test and store rules for enforcing conventions, and provides a skill to create those rules super easily. So you can come up with any arbitrary rule you like, get your agent to write a piece of code that enforces it, and then have it be included in your Pokayoke checks that get done (with one command) next to your other linting and formatting checks!

Fun fact: the name comes from the Japanese term for "mistake-proofing" or "error-prevention"[0].

[0] - https://en.wikipedia.org/wiki/Poka-yoke

Comments URL: https://news.ycombinator.com/item?id=48932314

Points: 1

# Comments: 0

Article URL: https://master.dev/blog/ai-generated-ui-is-inaccessible-by-default/

Comments URL: https://news.ycombinator.com/item?id=48932310

Points: 1

# Comments: 0

Article URL: https://investor.uber.com/news-events/news/press-release-details/2026/Uber-Announces-Acquisition-Offer-for-Delivery-Hero/default.aspx

Comments URL: https://news.ycombinator.com/item?id=48932277

Points: 3

# Comments: 0

I started working on this project last year and open-sourced it this year.

It’s a library to scan byte payloads within JS using YARA-syntax rules, enabling YARA malware detection rules to run anywhere that JS runs (e.g. browsers, email clients, Office add-ons etc). However, it goes beyond core YARA by adding runtime context signals to the rule evaluation, so users can write detections like “encrypted PDF being downloaded from an unfamiliar website” or “executable downloaded from service-worker enabled site”. It started for security applications, but can also be applied to DLP and compliance.

I come from the EDR and web security world, so I take inspiration from gaps that I find there. In this case, I wanted to improve threat detection in payloads downloaded via the browser.

File scanners sit outside the browser and rely on OS notifications to trigger a scan when a file is downloaded. The file scanner knows it came from Chrome but doesn’t know the website, referral chain or user interaction preceding the download. This context information could be useful in identifying 0-day threats where signatures are not yet available. I started exploring if it were possible to embed an inline scanner within the browser to use flexible rules and block downloads before they materialized on disk. I did not want to invent a new rule language, so I picked YARA as it is well-established and open-source. I first coded the YARA engine in vanilla JS, including modules, so it could be run in any JS runtime. I thought of cross-compiling to WASM but stuck with vanilla JS because I wanted to add runtime-specific customizations, which were easier to do in vanilla JS. Once the YARA engine was ready, I added an extra metadata object that could be passed and used in the rule syntax. This was done using the custom module route, to maintain compatibility with YARA. This became Intercept.js.

The open-source repo includes a lot more information about the implementation, videos, some coding examples and a hosted instance on Cloudflare Workers to try out

It would be great to find collaborators interested in refining the project. I am presenting this at BlackHat Arsenal and DEFCON Demo Labs, so I’m happy to meet folks there to dive into more technical details.

Thanks!

Comments URL: https://news.ycombinator.com/item?id=48932269

Points: 1

# Comments: 0

Article URL: https://www.bargo.ai/research/slow-takeoff-fast-spending

Comments URL: https://news.ycombinator.com/item?id=48932261

Points: 1

# Comments: 0

Comments URL: https://news.ycombinator.com/item?id=48932259

Points: 1

# Comments: 1

Article URL: https://www.flanner.io/

Comments URL: https://news.ycombinator.com/item?id=48932248

Points: 1

# Comments: 0

Article URL: https://github.com/Skyvern-AI/rustwright

Comments URL: https://news.ycombinator.com/item?id=48932230

Points: 2

# Comments: 0

Article URL: https://www.smh.com.au/business/workplace/no-hiring-if-an-ai-can-do-the-job-staff-at-mining-giant-told-20260713-p60eth.html

Comments URL: https://news.ycombinator.com/item?id=48932218

Points: 2

# Comments: 1

Article URL: https://research.mozilla.org/browser-competition/over-the-edge-2/

Comments URL: https://news.ycombinator.com/item?id=48932214

Points: 1

# Comments: 0

Article URL: https://zayenz.se/blog/post/gecode-6-3-and-6-4-released/

Comments URL: https://news.ycombinator.com/item?id=48932205

Points: 1

# Comments: 0

If you pay for something, you expect it to work as intended. The vendor shouldn’t start turning features off just because you won’t accept its new rules. Someone should tell Samsung, which just upset users of its health app by threatening exactly that—before changing course after a user backlash.

Nice data you have there. Shame if anything happened to it.

In mid-July, Samsung health users started seeing a new toggle titled Consent to the Use of Health Data for AI Training and Modelling.

Those flipping the toggle off reportedly saw a warning:

“You will not be able to sync health data with your Samsung account and your health data will be deleted unless retained pursuant to applicable law. If retention is required, we will erase it as soon as the required retention period ends.”

HowtoGeek has a copy of the original warning. Note the ominous options it provides: Cancel or Withdraw and delete data.

Image courtesy of HowToGeek

The warning effectively gave users a stark choice. Let Samsung use your intimate data to train its AI, or lose that data along with meaningful access to the health app.

Then, it backtracked. After user pushback and a query from enthusiast site SamMobile, Samsung clarified that withdrawing consent only removes data retained for AI training and modeling. Users’ health data and Samsung Cloud sync will continue to work normally. SamMobile confirmed that cloud sync kept running after consent was withdrawn.

A treasure trove of information

The frustrating part of this is that the more loyal a Samsung user was, the more the original threat would have hurt them. Some people have spent years letting Samsung harvest mountains of information in the app. That can include body measurements, nutrition, step count and activity, sleep, medications and dosages, clinical health records, and menstrual data. Consumer health apps like Samsung Health generally aren’t covered by HIPAA.

So just because Samsung has backtracked, should you let it have free access to your data for AI training? Consider the specific privacy document the app’s pop-up request now sends you to when you ask it for more details.

The document says it will use all of the above data, and that will be subject to human review, but doesn’t say whether those reviewers are Samsung staff or third-party contractors. There’s no mention of data anonymization in this document or in Samsung’s health app privacy policy. The broader 3,200-word Samsung privacy policy has a whopping two-sentence section on how it secures user data. It says that it will anonymize user data “in some cases”.

An industry pattern

None of this should surprise us. Technology companies have a habit of trying to change the rules and then stepping back if customers get angry enough.

Adobe told users it could do whatever it wanted with work they created with its tools in mid-2024, only to hurriedly promise not to train AI with it when people freaked out.

WhatsApp tried to make its users agree to share their data with Facebook in 2021. If they didn’t, features on the app would slowly stop working, it said. It eventually backpedalled globally after Indian and German regulators stood up to it.

In 2017, a Sonos executive warned that if users didn’t agree to its new privacy terms, their speakers could stop working altogether.

Then there’s Samsung itself. This isn’t the first time it has faced criticism over customer privacy. In March, it settled with the Texas Attorney General over collecting Smart TV viewing data without proper opt-in. Then there were allegations that some of its budget phones included software critics described as unremovable spyware. The privacy optics for the company haven’t been great lately.

What to do next

With incidents like these in mind, we think the best place to keep your data is always at home. By all means use the cloud, but back up data from cloud-based services whenever you can. Many of these, such as Apple and Google, let you download your data.

So if you use Samsung Health, press the three dots on the top right of the app and then select Settings. Then scroll down to the toggle that says Consent to the use of health data for AI training and modelling. Turn it off if you’re not happy with it. Before you do that, click Download personal data and grab a local copy. Just in case.

Your name, address, and phone number are probably already for sale.  

Data brokers collect and sell your personal details to anyone willing to pay. Malwarebytes Personal Data Remover finds them and gets your information removed, then keeps watch so it stays that way. 

SCAN NOW

Article URL: https://micro.mu/blog/post?id=build-your-own-apps

Comments URL: https://news.ycombinator.com/item?id=48932198

Points: 1

# Comments: 0

Article URL: https://blog.codacy.com/ai-code-review-is-not-enough-how-engineering-leaders-should-gate-ai-generated-code

Comments URL: https://news.ycombinator.com/item?id=48932183

Points: 1

# Comments: 1

Article URL: https://8bit.gioorgi.com//

Comments URL: https://news.ycombinator.com/item?id=48932178

Points: 1

# Comments: 2

Article URL: https://play.google.com/store/apps/details?id=com.gpsmapcamera.gpscameratimestamp.photo.video&hl=en_US

Comments URL: https://news.ycombinator.com/item?id=48932168

Points: 1

# Comments: 0

Attackers could exploit the bugs to modify configurations, terminate or restart processes, cross security boundaries, leak memory, and execute code.

The post F5 Patches Multiple NGINX, BIG-IP Vulnerabilities appeared first on SecurityWeek.

An app has appeared in India that lets anyone with a smartphone stop a passing e-rickshaw dead in its tracks - no login, no passwords, no permissions needed. Meanwhile, Geoff - swimming in money and Lamborghinis, as all published authors are - has been on the receiving end of a slew of AI-generated scam pitches from fake book marketing experts. Rather than ignore them, he's been playing them at their own game... All this and more in this episode of the "Smashing Security" podcast with cybersecurity expert and keynote speaker Graham Cluley, and special guest Geoff White.