Hacker News
1Can I disable all data collection from my vehicle?
- Rivian vehicle owners can disable all data collection by turning off cellular connectivity, but this will limit features like navigation, lane centering, and over-the-air updates. Canadian vehicles have a toggle in Settings, while other regions require contacting Rivian Service to disable the eSIM card through a service appointment.
Over-the-air updates vs dealer service
Discussion centers on regulatory gaps for EV safety recalls, where traditional ICE cars must support J2534 passthrough updates but EVs lack such requirements. Users debate whether OTA-only recalls are sufficient remedies and share experiences with dealership alternatives.Privacy concerns and data collection
Users express alarm over Mozilla's findings that car manufacturers collect highly invasive data including "sexual activity" and "genetic information." Discussion includes workarounds like disabling connectivity and criticism of all-or-nothing privacy options.Technical methods to disable connectivity
Users share practical approaches to disconnect vehicle telemetry, from physically removing OnStar units to using aftermarket kits. Discussion covers trade-offs between privacy and losing features like emergency services or lane assistance.
2How Mark Klein told the EFF about Room 641A [book excerpt]
- In 2006, retired AT&T technician Mark Klein visited the Electronic Frontier Foundation with evidence that the NSA was conducting mass surveillance of Americans' internet communications through a secret room (641A) in AT&T's San Francisco building, where fiber-optic cables were split to copy all traffic.
NSA surveillance violations before 9/11
Discussion reveals that the "wall" between NSA foreign surveillance and FBI domestic surveillance was routinely violated at least a decade before 9/11, with government employees bound by NDAs staying silent about illegal activities they witnessed.Government classification system abuse
Users debate the problematic nature of a classification system where documents can be classified without markings, making it impossible for citizens to verify if materials are classified while still facing prosecution for handling them.International surveillance cooperation
Comments explore how the US circumvents domestic surveillance restrictions through the Five Eyes alliance, with Britain spying on Americans and sharing intelligence with the NSA to avoid technically breaking laws.
3For Linux kernel vulnerabilities, there is no heads-up to distributions
Disclosure responsibility and process failures
Debate over whether the vulnerability reporter should have notified distributions directly, or if the Linux kernel security team failed by not coordinating with distros. Some argue the 30-day disclosure was irresponsible given lack of patches.Linux kernel security communication gaps
Discussion reveals kernel team is legally restricted from selective disclosure to distros - they must either tell everyone or no one. This creates coordination failures between kernel developers and distribution maintainers for security patches.Vulnerability mitigation and workarounds
Technical discussion of temporary fixes including module blacklisting, eBPF-based workarounds, and grub parameter changes. Some distributions had the vulnerable code compiled-in rather than as modules, limiting mitigation options.
4How an oil refinery works
- Oil refineries are massive industrial facilities that process crude oil into usable products like gasoline, chemicals, and plastics. They use distillation to separate crude oil's thousands of different molecules by heating and cooling at various temperatures, with lighter molecules condensing at the top and heavier ones at the bottom.
Refinery operations and environmental impact
Users share experiences visiting refineries, contrasting a clean Japanese facility with highly automated operations against polluted US plants near poor communities. Discussion covers flaring practices, odor control systems, and how environmental standards vary by location and economic power of surrounding areas.Personal connections to the oil industry
Several users share family experiences working at refineries, particularly the massive Jamnagar facility. Stories include growing up around refineries, safety incidents, and the impressive scale of operations. Discussion touches on Reliance's history and plans for US expansion.Gaming parallels and educational aspects
Users note how factory simulation games like Factorio and SpaceChem accurately represent oil refining processes. Discussion includes references to SimRefinery and how gaming provides intuitive understanding of complex industrial processes and byproduct management.
5Spain's parliament will act against massive IP blockages by LaLiga
- Spain's Congress approved measures to prevent indiscriminate IP blocking by courts in anti-piracy cases after complaints that LaLiga's piracy fight caused widespread legitimate website outages. The initiative will reform the Digital Services Act to require proportional measures and protect third parties from unintended blocking effects.
Cloudflare IP blocking impact
LaLiga obtained court orders forcing Spanish ISPs to block Cloudflare IPs during matches to prevent illegal streaming, causing widespread collateral damage to legitimate businesses and services sharing those IPs, with users reporting lost revenue and forced migrations.Legal and technical mechanisms
Discussion centers on why courts targeted ISPs rather than Cloudflare directly, with explanations about jurisdictional issues, Cloudflare's response time concerns, and the technical challenges of real-time content blocking during live matches.Stopping principles and proportionality
Users debate the lack of clear limits on blocking measures, arguing the approach could logically extend to shutting down the entire internet, while others discuss accountability and whether affected parties should sue for damages.
6Shai-Hulud Themed Malware Found in the PyTorch Lightning AI Training Library
- The Lightning PyPI package was compromised with malicious code that could steal sensitive data and execute unauthorized commands on infected systems. Users are advised to immediately uninstall the package and check for any unauthorized access to their systems.
Supply chain attacks are increasing
Discussion reveals supply chain attacks have dramatically increased, with 7 attacks in the past 12 months vs 9 in the previous two decades. Contributors debate whether this reflects actual increase or just better detection/reporting, citing factors like auto-updates, CI tools, and cryptocurrency creating more valuable targets.Dependency management concerns
Users express desire to reduce dependencies, with some adopting "no dependencies" approaches using AI code generation. Discussion covers tradeoffs between dependency convenience vs security risks, particularly in Python/ML ecosystems where projects often have hundreds of transitive dependencies.Attack details and impact
The malware created 2.2K GitHub repos with "A Mini Shai-Hulud has Appeared" message to exfiltrate stolen credentials. Lightning AI's PyPI credentials were compromised, leading to malicious versions 2.6.2 and 2.6.3 being published that steal environment variables, tokens, and cloud secrets.
7LinkedIn is scanning browser extensions
- LinkedIn secretly scans users' browsers to detect which Chrome extensions they have installed, building detailed profiles that include over 6,000 extensions without user consent or disclosure in their privacy policy. This fingerprinting goes beyond typical anonymous tracking since LinkedIn already knows users' professional identities, creating specific risks for journalists, researchers, and job seekers whose privacy tools and work activities can be monitored and potentially used against them.
How Chrome enables extension fingerprinting
Discussion about Chrome's security flaw allowing websites to detect installed extensions by trying to fetch extension files. Users question why browsers permit this, with explanations of the technical mechanism and comparisons to Firefox's randomized extension IDs.Ethical dilemmas for developers
Developers debate whether to comply with implementing invasive tracking features to keep their jobs or object on ethical grounds. Some share strategies like choosing employers carefully, working in public sector, or passive resistance.LinkedIn's justification and scope of tracking
Users analyze whether LinkedIn's extension scanning is standard fingerprinting practice or overreach. Debate centers on whether the tracked extensions are legitimate tools or primarily scrapers/spam bots that violate terms of service.
8Show HN: WhatCable, a tiny menu bar app for inspecting USB-C cables
- WhatCable is a free, open-source Mac menu bar app that identifies USB-C cable capabilities by reading data your Mac already has access to. When you plug in a cable, it displays the charging wattage, data speed, display support, and Thunderbolt compatibility in plain English.
App interface preferences
Users debated whether the app should live in the menu bar vs being a regular app or CLI tool. Developer responded by adding a toggle option and CLI functionality based on feedback.Cross-platform compatibility
Discussion about bringing similar functionality to Linux and Windows, with users sharing existing tools like lsucpd and creating KDE Plasma widgets using AI assistance.Developer responsiveness
Community praised the developer for shipping 16 releases in 7 hours, incorporating HN feedback in real-time with help from AI pair programming to add features like CLI support.
9Grok 4.3
- This appears to be the documentation homepage for xAI's Grok 4.3 AI model, providing comprehensive developer resources including REST and gRPC APIs, model capabilities for text, images, video, voice and files, advanced features like batch processing and WebSocket mode, tools for function calling and search, file management, pricing information, migration guides, and community resources for integrating and using Grok's AI services.
Grok's superior tone and communication style
Users praise Grok's ability to capture natural human tone and formality levels, especially for non-native English speakers. It excels at understanding linguistic subtleties and providing human-like responses without being overly formal or artificial, unlike ChatGPT's stiffness or Claude's inconsistency.Grok's practical applications and limitations
Discussion covers Grok's strengths in voice transcription, search capabilities, and handling sensitive topics other models refuse. However, users note significant limitations including lack of MCP support, missing project features, and weaker coding abilities compared to frontier models.Grok's association with Elon Musk and controversies
Debate about Grok's reputation being tied to racism/roleplay, Musk's political influence on the model's outputs, and ethical concerns about training data usage and safety practices, with some users expressing moral resistance to using Musk-affiliated products.
10Uber torches 2026 AI budget on Claude Code in four months
- Uber exhausted its entire 2026 AI budget in just four months due to explosive adoption of Claude Code and Cursor by engineers. Usage of Claude Code doubled by February, with 95% of engineers now using AI tools monthly at costs of $500-2,000 per person. The tools became so valuable that engineers couldn't stop using them despite skyrocketing expenses, forcing leadership to reconsider AI budgeting strategies.
High token costs and spending patterns
Discussion centers on how engineers burn through $1k-10k monthly in AI tokens through long conversations, subagent spawning, parallel worktrees, and wasteful usage patterns. Many question whether such spending delivers proportional business value.Measuring AI productivity and ROI
Users debate whether increased AI spending translates to actual productivity gains. Some argue true productivity would show measurable revenue increases, while others note the difficulty of measuring engineering productivity and lag time between investment and returns.Perverse incentives and gaming metrics
Discussion highlights how companies' AI usage mandates and token leaderboards create incentives for wasteful spending rather than productive use, with engineers gaming metrics by burning tokens unnecessarily to meet KPIs.