2026年04月01日 · 每日 AI 热门文章 · 中英文对照
It has recently come to my attention that people need a thousand lines of C code to read my website. This is unacceptable. For simpler clients, my server supports gopher: # telnet maurycyz.com 70 /about.txt --------------------[ About this site: ]--------------------- Publication date: 2026-02-03 Last updated: 2026-03-06 Yap, yap yap yap yap yap yap yap yap yap yap yap yap yap yap yap yap yap yap yap yap yap yap yap yap yap yap yap. Yap yap yap yap yap yap yap yap yap yap. ... The response is just a text file: it has no markup, no links and no embedded content. For navigation, gopher uses specially formatted directory-style menus: # telnet maurycyz.com 70 / 0READ ME FIRST /gopherinfo.txt maurycyz.com 70 i 1Files..........Programs /programs.map maurycyz.com 70 1 Rock photos /misc/rocks.map maurycyz.com 70 i 0Cool places....on the web /real_pages.txt maurycyz.com 70 1 on gopher /gopherholes.map maurycyz.com 70 i 1Blog...........Projects /projects/ maurycyz.com 70 1 Tutorials /tutorials/ maurycyz.com 70 1 Other /misc/ maurycyz.com 70 1 Photography /astro/ maurycyz.com 70 . The first character on a line indicates the type of the linked resource: 0 Plain text 1 Another directory ... (stuff I don't use) 9 Binary data I Image The type is followed by a tab-separated list containing a display name, file path, hostname and port. Lines beginning with an "i" are purely informational and do not link to anything. (This is non-standard, but widely used) Storing metadata in links is weird to modern sensibilities , but it keeps the protocol simple. Menus are the only thing that the client has to understand: there's no URLs, no headers, no mime types — the only thing sent to the server is the selector (file path), and the only thing received is the file. ... as a bonus, this one liner can download files: # 144 kB if you want to try it. echo /astro/m27/small.jpg | ncat maurycyz.com 70 > nebula.jpg That's quite clunky , but there are lots of programs that support it. If you have Lynx installed, you should be able to just point it at this URL: gopher://maurycyz.com ... although you will want to put ASSUME_CHARSET:utf-8 in /etc/lynx.cfg because it's not 1991 anymore [Citation Needed] I could use informational lines to replicate the webs navigation by making everything a menu — but that would be against the spirit of the thing: gopher is document retrieval protocol, not a hypertext format. Instead, I converted all my blog posts in plain text and set up some directory-style navigation. I've actually been moving away from using inline links anyways because they have two opposing design goals: While reading, links must be normal text. When you're done, links must be distinct clickable elements. I've never been able to find a good compromise: Links are always either distracting to the reader, annoying to find/click, or both. Also, to preempt all the emails : ... what about Gemini? (The protocol, not the autocomplete from google.) Gemini is the popular option for non-web publishing... but honestly, it feels like someone took HTTP and slapped markdown on top of it. This is a Gemini request... gemini://example.com/about.gmi ... and this is an HTTP request: GET /about.html HTTP/1.0 Host: maurycyz.com For both protocols, the server responds with metadata followed by hypertext. It's true that HTTP is more verbose, but 16 extra bytes doesn't create a noticeable difference. Unlike gopher, which has a unique navigation model and is of historical interest , Gemini is just the web but with limited features... so what's the point? I can already write websites that don't have ads or autoplaying videos, and you can already use browsers that don't support features you don't like. After stripping away all the fluff (CSS, JS, etc) the web is quite simple: a functional browser can be put together in a weekend. ... and unlike gemini, doing so won't throw out 35 years of compatibility: Someone with Chrome can read a barebones website, and someone with Lynx can read normal sites. ... also, when I'm downloading a large file, I want to know how long it's going to take . Despite sending metadata, Gemini doesn't include a length field. Considering that there are people on single digit kilobit/second connections, this is a significant oversight even for text. Their site lists a vague concern of extensibility and "gopher doesn't have it" as justifications. How exactly is giving the user an ETA on files going to allow JavaScript? ... and "it sucks elsewhere so we made it suck here" is hardly a justification. The usual solution is to host files on another protocol, but that breaks the promise of a simple client. If it has to support BitTorrent, HTTP/HTTPS, IPFS, FTP, etc, etc... it's not simple any more. --> Gemini is a technical solution to an emotional problem . Most people have a bad taste for HTTP due to the experience of visiting a commercial website. Gemini is the obvious choice for someone looking for "the web but without VC types". It doesn't make any sense when I'm looking for an interesting (and humor­ously outdated) protocol. Related: /projects/tinyweb/ : A browser in 1000 lines of C ... /about.html#links : ... and thoughts on links for navigation. https://www.rfc-editor.org/rfc/rfc1436.html : Gopher RFC https://geminiprotocol.net/ : Mentioned web alternative --> https://lynx.invisible-island.net/ : Feature complete text-based web browser
最近我注意到，人们需要一千行C代码才能阅读我的网站。这是不可接受的。对于更简单的客户端，我的服务器支持gopher ： # telnet maurycyz.com 70/about.txt--------------------[关于此站点：]---------------------发布日期： 2026-02-03最后更新： 2026-03-06 YAP ， yap yap yap yap yap yap yap yap yap yap yap yap yap yap yap yap yap yap yap yap yap yap yap yap yap yap yap yap yap yap yap yap yap yap yap yap yap yap yap yap yap yap yap yap yap yap yap yap yap yap yap yap yap yap yap yap YAP YAP YAP YAP YAP YAP YAP YAP YAP YAP。...响应只是一个文本文件：它没有标记，没有链接，也没有嵌入内容。 YAP YAP YAP YAP YAP YAP YAP YAP YAP YAP。...响应只是一个文本文件：它没有标记，没有链接，也没有嵌入内容。对于导航， gopher uses specially formatted directory-style menus: # telnet maurycyz.com 70 / 0READ ME FIRST /gopherinfo.txt maurycyz.com 70 i 1Files..........Programs /programs.map maurycyz.com 70 1 Rock photos /misc/rocks.map maurycyz.com 70 i 0Cool places....on the web /real_pages.txt maurycyz.com 70 1 on gopher /gopherholes.map maurycyz.com 70 i 1Blog...........Projects /projects/ maurycyz.com 70 1 Tutorials /tutorials/ maurycyz.com 70 1 Other /misc/ maurycyz.com 70 1 Photography /astro/ maurycyz.com 70 . YAP YAP YAP YAP YAP YAP YAP YAP YAP YAP。...响应只是一个文本文件：它没有标记，没有链接，也没有嵌入内容。对于导航，行上的第一个字符表示链接资源的类型： 0纯文本1另一个目录... （我不使用的东西） 9二进制数据I图像类型后跟一个制表符分隔的列表，其中包含显示名称、文件路径、主机名和端口。 以“i”开头的行纯粹是信息性的，不链接到任何东西。（这是非标准的，但被广泛使用）在链接中存储元数据对现代敏感度来说很奇怪，但它使协议保持简单。菜单是客户端必须理解的唯一内容：没有URL ，没有标头，没有MIME类型—发送到服务器的唯一内容是选择器（文件路径） ，收到的唯一内容是文件。... 作为奖励，这条线可以下载文件： # 144 kB ，如果你想尝试的话。echo/astro/m27/small.jpg | ncat maurycyz.com 70 > nebula.jpg这很笨拙，但有很多程序支持它。如果您已安装Lynx ，您应该能够将其指向此URL ： gopher://maurycyz.com... 虽然您希望在/etc/lynx.cfg中放置ASSUME_CHARSET: utf-8 ，因为它不再是1991年[需要引用]我可以使用信息行通过将所有内容都设置为菜单来复制Web导航—但这将违背事情的精神： gopher是文档检索协议，而不是超文本格式。相反，我将所有博客文章转换为纯文本，并设置了一些目录式导航。 实际上，我一直在远离使用内联链接，因为它们有两个相反的设计目标：在阅读时，链接必须是普通文本。完成后，链接必须是独特的可点击元素。我从来没有找到一个好的妥协方案：链接总是会分散读者的注意力，让人讨厌找到/点击，或者两者兼而有之。此外，要抢占所有电子邮件：...双子座怎么办？ （协议，而不是谷歌的自动完成。）双子座是非网络发布的热门选择……但老实说，感觉就像有人拿走了HTTP ，并在其上加了扣分。这是一个双子座请求... gemini://example.com/about.gmi...这是一个HTTP请求： GET/about.html HTTP/1.0 Host: maurycyz.com对于两种协议，服务器都使用元数据后跟超文本进行响应。 HTTP确实更冗长，但16个额外的字节不会产生明显的差异。与具有独特导航模型并具有历史意义的Gopher不同， Gemini只是网络，但功能有限......那么有什么意义呢？我已经可以编写没有广告或自动播放视频的网站，并且您已经可以使用不支持您不喜欢的功能的浏览器。 在去除了所有绒毛（ CSS、JS等）之后，网络非常简单：一个功能正常的浏览器可以在周末组装在一起。...与双子座不同，这样做不会丢失35年的兼容性： Chrome用户可以读取精通网站，而Lynx用户可以读取正常网站。...此外，当我下载大文件时，我想知道需要多长时间。 尽管发送元数据， Gemini不包含长度字段。考虑到有人使用单位千比特/秒的连接，即使对于文本来说，这也是一个重大的疏忽。他们的网站列出了一个模糊的可扩展性问题， “地鼠没有它”作为理由。如何准确地为用户提供允许JavaScript的文件的ETA ？... “它在其他地方很糟糕，所以我们让它在这里很糟糕”几乎不是一个理由。 通常的解决方案是在另一个协议上托管文件，但这违反了简单客户端的承诺。如果必须支持BitTorrent、HTTP/HTTPS、IPFS、FTP等……那就不再简单了。-- >双子座是情绪问题的技术解决方案。由于访问商业网站的体验，大多数人都对HTTP有不好的品味。对于寻找“网络但没有VC类型”的人来说， Gemini是显而易见的选择。 当我在寻找一个有趣（而且幽默地过时）的协议时，这是没有任何意义的。相关：/projects/tinyweb/: 1000行C的浏览器.../about.html#links:...和导航链接的想法。https://www.rfc-editor.org/rfc/rfc1436.html: Gopher RFC https://geminiprotocol.net/:提到的网络替代品-->https://lynx.invisible-island.net/:功能完整的基于文本的网络浏览器Supply Chain Attack on Axios Pulls Malicious Dependency from npm Useful writeup of today's supply chain attack against Axios, the HTTP client NPM package with 101 million weekly downloads . Versions 1.14.1 and 0.30.4 both included a new dependency called plain-crypto-js which was freshly published malware, stealing credentials and installing a remote access trojan (RAT). It looks like the attack came from a leaked long-lived npm token. Axios have an open issue to adopt trusted publishing , which would ensure that only their GitHub Actions workflows are able to publish to npm. The malware packages were published without an accompanying GitHub release, which strikes me as a useful heuristic for spotting potentially malicious releases - the same pattern was present for LiteLLM last week as well. Via lobste.rs Tags: javascript , security , npm , supply-chain
关于今天针对Axios的供应链攻击的详细分析。Axios是每周下载量达1.01亿次的HTTP客户端NPM包。1.14.1和0.30.4版本都包含了一个名为plain-crypto-js的新依赖，这是一个新发布的恶意软件，用于窃取凭证并安装远程访问木马（RAT）。此次攻击似乎来自一个泄露的长期有效的npm token。Axios有一个开放issue，提议采用可信发布（trusted publishing）机制来防止此类攻击。Grace Kay, Ashley Stewart, and Pranav Dixit, writing for Business Insider ( News+ ): “Part of bringing me on, and giving me the responsibilities of a CEO, was to make sure that I could really run that part of the company with autonomy,” Simo, whose title is CEO of applications, told Business Insider. Altman defers to Simo when he doesn’t feel strongly, she said, and they “debate it out” when he does. I am deeply suspicious of any company with two CEOs. It occasionally works, like at Netflix , when they’re not just co-CEOs but co-equals. Simo does not seem Sam Altman’s equal at OpenAI. As OpenAI races toward a possible IPO later this year, Simo, who oversees nearly two-thirds of the company, has a delicate balancing act. She must craft a strategy to make products profitable, while convincing staffers who joined a research-driven organization that commercialization won’t change the mission. The stakes are high. Deutsche Bank estimated that OpenAI is expected to amass the “largest startup losses in history,” totaling a projected $143 billion between 2024 and 2029. (An OpenAI spokesperson said that figure is incorrect, and one person familiar with the numbers said OpenAI’s internal projections are in line with other reports of $111 billion cash burn by 2030.) It’s really something when the number in the company’s favor is a loss of $111 billion. One former Meta employee recalled a moment when, after a contentious meeting, Simo sent a one-line follow-up saying she was unlikely to change her mind, so the team shouldn’t waste time trying to persuade her. She has little patience for internal debates that lose sight of the product, the former employee said, and she’s skilled at “being super clear in her directive so teams don’t scramble and waste time.” Debates that lose sight of the product quality , or lose sight of the product revenue ? Given that Simo rose to prominence at Facebook , eventually running the Facebook blue app, and considering the product quality vs. product revenue balance of that app, I think we know the answer. This whole dumb “superapp” idea that leaked last week sounds exactly like the sort of thing someone who ran the Facebook app would think is a good idea. The difference, I expect, is that Facebook is free to let product quality (and experience quality) fall by the wayside because their social platforms have such powerful network effects. People stay on Facebook and Instagram even as the experiences worsen because everyone they know is also still on those apps. There’s no network effect like that for ChatGPT. Claude is already rising to near-equal status in popularity, and Gemini isn’t far behind, and Simo hasn’t even started enshittifying ChatGPT yet. People will just switch. ★
格蕾丝·凯（ Grace Kay ）、阿什利·斯图尔特（ Ashley Stewart ）和普拉纳夫·迪克西特（ Pranav Dixit ）在为《商业内幕》（ Business Insider ） （ News + ）撰写文章时表示： “让我成为首席执行官并赋予我CEO职责的一部分，就是确保我能够真正自主地经营公司的这一部分，”西莫（ Simo ）是应用程序的首席执行官，他告诉《商业内幕奥尔特曼说，当西莫感觉不强烈时，他会服从他，当他感觉不强烈时，他们会“争论”。 我对任何有两位首席执行官的公司深表怀疑。它偶尔会起作用，就像在Netflix一样，当他们不仅仅是联合首席执行官，而是共同平等的时候。Simo似乎不如Sam Altman在OpenAI。随着OpenAI在今年晚些时候可能进行首次公开募股，负责监管该公司近三分之二股份的Simo采取了微妙的平衡行动。 她必须制定一项战略，使产品盈利，同时说服加入研究型组织的员工，商业化不会改变这一使命。赌注很高。德意志银行估计， OpenAI预计将累积“历史上最大的创业亏损” ，预计在2024年至2029年之间总计将达到1430亿美元（ $ ）。 （ OpenAI的一位发言人表示，这一数字是不正确的，一位知情人士表示， OpenAI的内部预测与其他报告一致，即到2030年将烧毁1110亿美元的现金。）当对公司有利的数字是1110亿美元的亏损时，这真的很重要。 一位前Meta员工回忆说，在一次有争议的会议后， Simo发送了一条线跟进，说她不太可能改变主意，所以团队不应该浪费时间试图说服她。 这位前员工说，她对忽视产品的内部辩论几乎没有耐心，她擅长“对她的指示非常清楚，这样团队就不会争吵和浪费时间。“忽视产品质量的争论，还是忽视产品收入的争论？鉴于Simo在Facebook上崭露头角，最终运行了Facebook蓝色应用程序，并考虑了产品质量与 该应用程序的产品收入平衡，我想我们知道答案。上周泄露的这个愚蠢的“超级应用”想法听起来就像运行Facebook应用程序的人会认为这是一个好主意。我预计，不同之处在于， Facebook可以自由地让产品质量（和体验质量）下降，因为他们的社交平台具有如此强大的网络效应。 即使体验恶化，人们也会继续使用Facebook和Instagram ，因为他们认识的每个人仍然使用这些应用程序。ChatGPT没有这样的网络效应。Claude的受欢迎程度已经上升到近乎平等的地位， Gemini也不甘落后， Simo甚至还没有开始整合ChatGPT。人们只需切换。 ★Hana Kiros, writing for The Atlantic: Recently, a Costco in Florida instituted a new store policy. An employee told me that he was asked to open up every desktop computer displayed in the electronics section and remove the memory chips. Otherwise, the RAM harvesters would get them. Elsewhere, criminal groups are misdirecting trucks carrying RAM in order to loot them. All of this is happening because of a generational shortage of a part used in practically every electronic gadget on Earth. Two of the best movies ever made, John McTiernan’s Die Hard in 1988, and Michael Mann’s Heat in 1995, revolved around plots to steal bearer bonds . (Also: Beverly Hills Cop — not quite one of the best films ever made, but a classic, for sure.) But bearer bonds have fallen out of favor as the world of legitimate finance has become almost entirely digital. A good heist film targeting a big shipment of RAM chips would be very 2026. ★
Hana Kiros为《大西洋月刊》撰文：最近，佛罗里达州的一家Costco制定了一项新的门店政策。一位员工告诉我，他被要求打开电子部分显示的每台台式电脑，取出内存芯片。否则，公羊收割机会得到它们。在其他地方，犯罪集团正在误导携带RAM的卡车，以便抢劫它们。 所有这些都是由于地球上几乎所有电子设备所使用的部件代代相传的短缺而发生的。有史以来最好的两部电影，约翰·麦克蒂尔南（ John McTiernan ） 1988年的《死硬》（ Die Hard ）和迈克尔·曼（ Michael Mann ） 1995年的《热火》（ Heat ） ，都围绕着窃取无记名债 （还有：《比佛利山庄的警察》--不是有史以来最好的电影之一，但肯定是一部经典电影。）但随着合法金融世界几乎完全数字化，无记名债券已经失宠。针对大量RAM芯片的抢劫电影将是2026年。 ★Release: datasette-llm 0.1a4 Ability to configure different API keys for models based on their purpose - for example, set it up so enrichments always use gpt-5.4-mini with an API key dedicated to that purpose. #4 I released llm-echo 0.3 to provide an API key testing utility I needed for the tests for this new feature. Tags: llm , datasette
版本发布：datasette-llm 0.1a4 新增根据模型用途配置不同API key的功能——例如，可以设置富集任务始终使用专为此目的配置的gpt-5.4-mini API key。#4 我发布了llm-echo 0.3，作为我测试这个新功能所需的API key测试工具。标签：llm、datasetteRelease: llm-all-models-async 0.1 LLM plugins can define new models in both sync and async varieties. The async variants are most common for API-backed models - sync variants tend to be things that run the model directly within the plugin. My llm-mrchatterbox plugin is sync only. I wanted to try it out with various Datasette LLM features (specifically datasette-enrichments-llm ) but Datasette can only use async models. So... I had Claude spin up this plugin that turns sync models into async models using a thread pool. This ended up needing an extra plugin hook mechanism in LLM itself, which I shipped just now in LLM 0.30 . Tags: llm , async , python
版本发布：llm-all-models-async 0.1 LLM插件可以同时定义同步和异步变体的模型。异步变体对于API支持的模型最为常见——同步变体通常是直接在插件内运行模型的类型。我的llm-mrchatterbox插件仅支持同步模式。我想尝试将它与各种Datasette LLM功能一起使用（特别是datasette-enrichments-llm），但Datasette只能使用异步模型。所以……我让Claude帮助创建了这个将同步模型转换为异步模式的插件。Release: llm 0.30 The register_models() plugin hook now takes an optional model_aliases parameter listing all of the models, async models and aliases that have been registered so far by other plugins. A plugin with @hookimpl(trylast=True) can use this to take previously registered models into account. #1389 Added docstrings to public classes and methods and included those directly in the documentation. Tags: llm
版本发布：llm 0.30 register_models()插件钩子现在接受一个可选的model_aliases参数，列出到目前为止由其他插件注册的所有模型、异步模型和别名。具有@hookimpl(trylast=True)的插件可以使用此功能来考虑先前注册的模型。#1389 为公共类和方法添加了docstrings，并将其直接包含在文档中。标签：llmRelease: llm-echo 0.4 Prompts now have the input_tokens and output_tokens fields populated on the response. Tags: llm
版本发布：llm-echo 0.4 提示词现在在响应中填充了input_tokens和output_tokens字段。标签：llmHi! If you like this piece and want to support my independent reporting and analysis, why not subscribe to my premium newsletter? It’s $70 a year, or $7 a month, and in return you get a weekly newsletter that’s usually anywhere from 5,000 to 18,
嗨！如果你喜欢这篇文章并想支持我的独立报道和分析，为什么不订阅我的高级通讯呢？每年70美元，或每月7美元，作为回报，你每周会收到一份通常在5000到18000字之间的通讯。OR: if we were playing by Settlers of Catan rules, I'd be dead already
或者说：如果我们按照《卡坦岛》的规则来玩，我可能已经死了……Nvidia CEO Jensen Huang, during an on-stage interview at The Hill & Valley Forum last week, was asked “What do you see as America’s unique advantages that other countries don’t have?” His answer, after taking a moment to think, “America’s unique advantage that no country could possibly have is President Trump.” Huang, newly appointed to the aforelinked President’s Council of Advisors on Science and Technology, seemingly doesn’t smell the growing stink . ★
英伟达首席执行官黄延森(Jensen Huang)上周在山谷论坛(The Hill & Valley Forum)的舞台采访中被问到： “你认为美国的独特优势是什么，其他国家没有的？他的回答是，在花了一点时间思考之后，“美国的独特优势是特朗普总统，这是任何国家都不可能拥有的。“新任命为前述总统科技顾问委员会成员的Huang ， 似乎闻不到越来越臭的味道。 ★Release: llm-echo 0.3 Mechanisms for testing tool calls . #3 Mechanism for testing raw responses . #4 New echo-needs-key model for testing model key logic . #7 Tags: llm
版本发布：llm-echo 0.3 #3 工具调用测试机制。#4 用于测试原始响应的机制。#4 用于测试模型key逻辑的新echo-needs-key模型。#7 标签：llmThe White House: The Council will be co-chaired by David Sacks and Michael Kratsios. The following individuals have been appointed: Marc Andreessen Sergey Brin Safra Catz Michael Dell Jacob DeWitte Fred Ehrsam Larry Ellison David Friedberg Jensen Huang John Martinis Bob Mumgaard Lisa Su Mark Zuckerberg Under President Trump, PCAST will focus on topics related to the opportunities and challenges that emerging technologies present to the American workforce, and ensuring all Americans thrive in the Golden Age of Innovation. Scientific American observes that 12/13 are executives, and only one, Martinis, is an academic researcher. But I mean, of course a council like this, from this administration, is going to be made up of big-cap corporate executives and founders. I’d say it’s more surprising there is even one academic researcher than that there aren’t more. I’m more intrigued by the companies who aren’t represented: no one from Apple, no one from Microsoft, no one from Amazon. (That left room for two from Oracle, that well known bastion of corporate virtue.) Read into that what you will. Me, I can’t help but suspect that this administration is taking on a profound stink, and something like appointments to this council are akin to a game of music chairs where Tim Cook, Satya Nadella, Andy Jassy, and Jeff Bezos are happy not to have gotten seats. ★
白宫：理事会将由David Sacks和Michael Kratsios共同主持。 已任命以下人员： Marc Andreessen Sergey Brin Safra Catz Michael Dell Jacob DeWitte Fred Ehrsam Larry Ellison David Friedberg Jensen Huang John Martinis Bob Mumgaard Lisa Su Mark Zuckerberg在特朗普总统的领导下， PCAST将专注于与新兴技术给美国劳动力带来的机遇和挑战相关的主题，并确保所有美国人在创新的黄金时代茁壮成长。 《科学美国人》观察到， 12/13是高管，只有一个，马提尼斯，是学术研究人员。但我的意思是，当然，像这样的委员会，来自本届政府，将由大型企业的高管和创始人组成。我想说，更令人惊讶的是，甚至有一个学术研究人员，而不是没有更多。 我对没有代表的公司更感兴趣：没有来自苹果的人，没有来自微软的人，没有来自亚马逊的人。（这为甲骨文留下了两个空间，甲骨文是著名的企业美德堡垒。）阅读您想要的内容。 我，我忍不住怀疑这届政府正在经历一场深刻的恶臭，而这个委员会的任命就像一场音乐椅游戏，蒂姆·库克、萨蒂亚·纳德拉、安迪·雅西和杰夫·贝索斯很高兴没有得到席位。 ★Thereallo, after spelunking inside the APK bundle for the Android version: Has a full GPS tracking pipeline compiled in that polls every 4.5 minutes in the foreground and 9.5 minutes in the background, syncing lat/lng/accuracy/timestamp to OneSignal’s servers. Loads JavaScript from a random person’s GitHub Pages site ( lonelycpp.github.io ) for YouTube embeds. If that account is compromised, arbitrary code runs in the app’s WebView. [...] Is any of this illegal? Probably not. Is it what you’d expect from an official government app? Probably not either. Hanlon’s razor : “Never attribute to malice that which is adequately explained by stupidity.” The app is, at least temporarily, popular. As I type this it’s #3 in the iOS App Store top free apps list , sandwiched between Claude and Gemini. I don’t know how similar the iOS app is to the Android one, but I took one for the team and installed it, and after poking around for a few minutes, it hasn’t even prompted me to ask for location access. It’s a crappy app, to be sure. A lot of flashing between screen transitions. When you open an article, there’s a “< Back” button top left, and an “X” button top right . Both buttons seem to do the same thing. There’s no share sheet for “news” articles, which seems particularly stupid. You can’t even copy a link to an article and share it manually. But the iOS version has a clean privacy report card in the App Store , and I don’t see anything in the app that makes me doubt that. It seems like the Android version is quite different. Update 1: Someone on Reddit claims to have analyzed the iOS app bundle and discovered similar code as in the Android app, but I still don’t see any way to actually get the iOS app to even ask for location permission. I think there might be code in the app that never gets called. Like I wrote above, it’s clearly not a well-crafted app. If anyone knows how to get the iOS app to actually ask for location access, let me know how . Here’s another analysis of the iOS app . Update 2: I installed the Android version of the app too, and just like on iOS, the only permission it asks for is to send notifications. Maybe they will in a future software update, but as far as I can see, the app never even tries to check the device’s location, on either platform. ★
在那里，在Android版本的APK捆绑包中进行挖掘后：具有完整的GPS跟踪管道，每4.5分钟在前台进行一次投票，每9.5分钟在后台进行一次投票，将LAT/LNG/ACCUSITY/TIMESTAMP同步到OneSignal的服务器。从随机人员的GitHub Pages网站(lonelycpp.github.io)加载用于YouTube嵌入的JavaScript。如果该帐户遭到入侵，任意代码将在应用的WebView中运行。 [...] Is any of this illegal? Probably not. Is it what you’d expect from an official government app? Probably not either. Hanlon’s razor : “Never attribute to malice that which is adequately explained by stupidity.” The app is, at least temporarily, popular. As I type this it’s #3 in the iOS App Store top free apps list , sandwiched between Claude and Gemini. I don’t know how similar the iOS app is to the Android one, but I took one for the team and installed it, and after poking around for a few minutes, it hasn’t even prompted me to ask for location access. It’s a crappy app, to be sure. A lot of flashing between screen transitions. When you open an article, there’s a “< Back” button top left, and an “X” button top right . Both buttons seem to do the same thing. There’s no share sheet for “news” articles, which seems particularly stupid. You can’t even copy a link to an article and share it manually. But the iOS version has a clean privacy report card in the App Store , and I don’t see anything in the app that makes me doubt that. It seems like the Android version is quite different. Update 1: Someone on Reddit claims to have analyzed the iOS app bundle and discovered similar code as in the Android app, but I still don’t see any way to actually get the iOS app to even ask for location permission. I think there might be code in the app that never gets called. Like I wrote above, it’s clearly not a well-crafted app. If anyone knows how to get the iOS app to actually ask for location access, let me know how . Here’s another analysis of the iOS app . Update 2: I installed the Android version of the app too, and just like on iOS, the only permission it asks for is to send notifications. Maybe they will in a future software update, but as far as I can see, the app never even tries to check the device’s location, on either platform. ★ I’m skeptical that quantum computing will become practical. However, if it does become practical before we’re prepared, the world’s financial system could collapse. Everyone agrees we should prepare for quantum computing, even those of us who doubt it will be practical any time soon. Quantum computers exist now, but the question is when and if […] The post Quantum Y2K first appeared on John D. Cook .
我对量子计算能否变得实用持怀疑态度。然而，如果它在我们在做好准备之前就变得实用了，世界的金融系统可能会崩溃。每个人都同意我们应该为量子计算做好准备，即使是我们这些怀疑它短期内不会实用的人。量子计算机现在已经存在，但问题是什么时候以及是否……