Playing around with Catodon and really enjoying it. I just thought it was really interesting to note that emoji reactions do federate. Although for some reason Piefed shows 2 when there's only 1.

For those unfamiliar "'keys" are the many Misskey forks. i.e. Catodon, Iceshrimp, Sharkey, etc.

New Discord clone ("Harmony") with a suspiciously AI-looking website, a single contributor, and blistering development = AI. Took me a minute to find it but it looks like they were scrubbed from a few places ~3 weeks ago.

https://github.com/y4my4my4m/harmony/pull/82

Saw Wendell do this on the latest GN video and for some reason just knew it needed to be a thing.

I shared a link from NPR Tiny Desk but there was no image preview or video embed. After investigating this I learned that when you do that, each instance picks up the link and individually retrieves the link preview nearly simultaneously. For gargantuan sites like YT or Reddit, this is a trivial amount of traffic and not a problem, but for smaller sites like NPR this results in a sort of botnet DDOS attack on the site's servers. More here. Another example here . For that reason, NPR has blocked Fediverse servers like Mastodon.

I have experienced this on my personal server as well (DDOS), but at the time didn't know why, exactly.

This isn't the end of the world, but certainly is not great and hurts engagement with the content. Is there a solution for this? Perhaps using some sort of webtorrent service like PeerTube where they just fetch the information from another fediverse server instead of the source server? Maybe fetching embeds client-side? At least that would stagger the requests.

E: Many people have replied comparing this to the Reddit "hug of death" or "The Slashdot effect". This is not the same at all. Those are legitimate site visits from humans that happen over the course of several hours. This is the result of several thousand servers all automatically fetching the same image simultaneously , and without any human involvement, and potentially next to zero human traffic to the site, which is why I compared it to a botnet or DDOS attack.

Recently Andy Yen dumped a whole boatload of suggestions about the future of Proton. Article is machine-translated so some discrepancies may exist.

Regarding Chromium:

But suddenly, it's mainly a problem of open web standards, don't you think? This is the discussion we always have with Sir Tim, the W3C and others. To some extent, this battle is long lost, to be completely honest...Yes, I think this battle is already lost.

Everyone assumed we were building a browser because a job posting came up, but that's not necessarily the case. We do a lot of web-related things at Proton, and there are plenty of reasons why I might want to hire someone who is very fluent in browsers. That doesn't mean we're building one....I don't say anything at all, because I don't know what I will build in the future.

I am often asked the question of instant messaging: "Create a chat", etc. Do I think we will ever do it? We'll end up doing everything, it's just a question of schedule and timing...You also have to understand the logic: with Proton Workspace, we want to compete with Microsoft 365 and Google Workspace .

Interesting confirmation of what we all probably already suspected.

I know "it works", but I'm wondering how it works? I know you can connect it over Bluetooth and use it as a normal controller, but does it work like a VR controller? I read that it has the necessary LEDs but they're obviously completely invisible. I haven't seen anyone use it this way, despite all my searching. I would like to be able to navigate the Frame UI without switching to the other controllers...

Specifically, SteamOS for the Steam Frame. I have so many questions. The Frame runs "SteamOS". Only SteamOS is based on Arch/x86, and the Frame runs ARM/Qualcomm, so surely this is a sort of "SteamOS for ARM"? I understand FEX (ish), are they just running the entire OS through FEX? Arch doesn't seem to have an ARM version I can find so did Valve do the work of porting Arch to ARM? And if so, where is the source code?

Not really sure if this is the right place to post this but I just need it written somewhere for reference when people inevitably give me shit for "not reading the article". Here's the thing:

1. The only thing you've provided is a clickbaity title and a link that tells me almost nothing about the content of the article. This actively makes me not want to click. Include some context in your post, or add it to the title. I know you're not supposed to "editorialize" the title, but I think it's fair to make an exception in the case of clickbait.
2. Site is broken/paywalled/blocking my connection or otherwise inaccessible. If you link to an Archive site, those are inaccessible 100% of the time. If you send me to Nitter, it will almost certainly be either broken or block my access. Invidious is almost always broken. Even if you pay to share a NYT link with me, they will still refuse me access until I give them an email address. Sorry, not doing it, don't care that much.
3. The post/article you've shared is just a long drawn out post with gobs of unnecessary context about a 1 or 2 sentence Xeet or Reddit post. Just share the source content.
4. The post/article you've shared does not contain a source of the information at all. It's so patently absurd that we allow publications to get away with this. They often have a couple dozen links that go nowhere except back to their own page.
5. Advertising. I do not consent to sharing my cookie information with your 1056 advertising partners. Nor do I want to click your pop-up banner to allow "strictly necessary" (whatever the fuck that means) cookies. If I use my adblocker to remove the cookie banner without actually giving them any permissions at all so I can see the God damn page, it often breaks the page . If my ad blocker misses it, I'm just leaving .
6. I'm not spending 1 hour watching your clickbait video. YouTube incentivizes creators to make longer videos, and so the creators will fill them with a ton of bloat to lengthen them. YouTube also very often blocks me as well, prompting me to "sign in to confirm you're not a bot". I'm not doing it.

In short, the modern internet just fucking blows too much for me to even bother trying to work around all this bullshit. If you link to some obscure blog from a URL I don't recognize, I'll probably click and read it, because those are the only selfless unmonetized publications left.

Thank you for coming to my Ted Talk.

Where Fluxer is headed in 2026 and what we're working on next.

With the new Mission Efficiency, Volkswagen is presenting the world's most efficient near-production electric car. The prototype has set three world records. They stand for exemplary aerodynamics and excellent ideal and real fuel consumption. The vehicle is a beacon of technology and at the same time demonstrates the performance of Volkswagen's production technology.

No plans for production

The leak involves telling Android to create a keep-alive UDP connection that is offloaded to the hardware Wi-Fi or cellular chip.

GOS fix in progress. Google has reportedly declined the bug report/bounty.

We have a partial port of GrapheneOS to the Pixel 11 series after a week of work on it. We're unable to complete the port due to lack of support for ARM hardware memory tagging in software, firmware and near certainly hardware. It appears Google cut an important security feature to save money.

ARM hardware memory tagging (MTE) is used by GrapheneOS across the entire base OS including the kernel and every standard base OS process. It's only temporarily disabled for a few device-specific processes. It greatly improves protection against nearly all remote exploits and many local exploits.

Pixel 8 launched with hardware MTE support in October 2023. We integrated it into our hardened_malloc project and began using it across the OS later that month. Android and the Pixel OS never started using it by default. Android Advanced Protection Mode in Android 16 enables it for a few processes.

Apple's Memory Integrity Enforcement (MIE) is an always enabled feature on the iPhone 17. It's simply a high quality implementation of MTE using the latest standard extensions. It uses MTE in the most secure mode in the kernel and a large portion of userbase. They did a very good job integrating it.

Apple's MIE and Android 16+ AAPM don't use MTE for user installed apps unless those explicitly opt in. GrapheneOS enables it for more apps automatically and has a toggle for users to opt-in for every user installed app. There's a per-app toggle to opt-out for incompatible apps which is uncommon.

Neither iOS or Android encourage app developers to opt into MTE and other more aggressive security features used in the base OS. Apple's docs warn developers of performance and stability issues. Even Signal doesn't opt-in. Our approach enables forcing using MTE in the standard allocators regardless.

Pixel 11 does have security improvements including moving to post-quantum secure verified boot (ML-DSA) and replacing Samsung Shannon IMS with AOSP IMS. Titan M3 should significantly improve protection against data extraction in Before First Unlock state. It's too bad they ruined it by cutting MTE.

Pixel 11 series is a lot more expensive for an incremental improvement to the CPU, the same underpowered GPU and reduced RAM for the Pro base models. They finally caught up to the last generation of Qualcomm cellular radio. It's overpriced, the upgrades aren't impressive and losing MTE is appalling.

Compared to the Pixel 11, a Snapdragon 8 Elite Gen 5 has 40% higher single threaded CPU performance, 80% higher multi threaded performance, over 100% higher GPU performance and a far better cellular radio. It also finally has MTE. The next gen is what will be in the first Motorola with GrapheneOS.

Pixel 9a and earlier (including Nexus devices) were the Android Open Source Project reference devices. Pixel support was removed from AOSP with Android 16. It's now harder to support Pixels than many other devices and massive progress towards open source firmware and driver libraries was discarded.

Compared to the stock Pixel OS, GrapheneOS ships AOSP patches months earlier and Linux kernel patches many months earlier. However, we rely on them for firmware and most driver updates. We also want to move to new kernel branches earlier. These things can be improved with our Motorola partnership.

We strongly recommend against buying Pixel 11 devices. Pixel 8, 9 and 10 have much better overall security for GrapheneOS. Pixel 10 is cheaper with similar hardware and MTE. Pixel 11's Titan M3 should improve BFU security for users without a strong passphrase, but losing MTE craters AFU security.

We haven't determined what to do about this situation. It may be best for us to skip the Pixel 11 series devices. We can shift our focus entirely to the upcoming Motorola devices instead. Pixel 10a was really a 9th gen Pixel, so hopefully the Pixel 11a does the same with 10th gen and includes MTE.