Same but shorter: https://noslopgrenade.com/

This was recently on the front page as well https://gruhn.me/blog/2026-08-03/

I always ask myself why Google's Gemini integration still feels that bad despite the company having full control over Android, the Play Store, and the Pixel hardware stack. If one could fully operate any feature on the phone with Gemini (and combine actions into workflows and tasks), that would at least for me be the next evolutionary step in "smart" phones.

Because Android does not just run on Pixel devices, and the level of control you suggest isn't something that can be bolted on at the manufacturer level.

They're slowly adding some of that functionality in, but obviously relies on third party adoption for anything more than UI automated control:

https://www.androidauthority.com/gemini-automation-control-o...

https://blog.google/innovation-and-ai/products/gemini-app/an...

What would you use that for? That feels very gimmicky to me

Mostly when driving or not being able to hold the phone. E.g. things that don't work: open my garage door using an action in an app; yesterday I wanted to send an address stored in Gmaps to a contact via messaging app; using controls currently displayed by Android Auto without having to touch the screen.

Often kids are playing the game and kids want to play what their friends play and that's most likely not mineclonia.

So first I'd test mods [1] that improve performance. The best thing about java Minecraft is the modding scene.

[1] https://modrinth.com/collection/Dtkcqkms/mods

Had the same question then read the whitepaper (section 6).

https://github.com/permissionlesstech/bitchat/blob/main/WHIT...

I guess this sort of tool provides a good learning experience for developers or implementing one scratches some other itch, because there are so many one here:

<https://hn.algolia.com/?dateRange=all&query=peer%20file%20sh...>

TL;DW: Some LG PC monitors (increasing models - also older models) auto install adware via Windows Update as soon as they are connected. Additionally, LG TVs secretly listen in and send pretty much all data back home.

Thanks for the link. I will make sure never to buy any LG product ever again.

Unfortunately, it is almost impossible to buy a TV (65"+) that isn't a "smart" TV (where smart == exfiltrating data and/or showing ads). If anyone has any recommendations, I would be grateful.

I am working on this personal casting device and I have been using it for both personal use and other work use-cases, here is a demo: https://www.youtube.com/watch?v=jObZzI2_pv0

Just like youtube, I can log in to my netflix, amazon prime and then use the touch screen to choose the movie to watch and it gets played on the external screen.

For few years the solution was to buy any TV you like, not connect it to internet and use some cheap streaming box. Nowadays even Roku added ads to its devices, so the question became: which streaming services are easy to whitelist on router, cause my consumer devices are too unsafe to allow them internet access.

I believe the only way is to deny internet connection to the TV and add a HTPC via HDMI.

I believe you can pass network traffic over the HDMI cable.

https://www.slashgear.com/2102867/why-do-some-hdmi-cables-ha...

I'd choose Cambridge, as I am sure that it provides the opportunity to meet a lot of influential people that you might be glad to have in your contacts later on in life, as well as a masters from there will open a lot of doors alone.

This clearly is a copied response from Claude for something like "Summarize RESULTS.md so that i can use it as a comment for HN."

So from a quick read, it seems it installed "atomic-lockfile", "js-digest" or "lockfile-js" from npm. A list of affected packages is here [1].

Didn't find any quick info on how to check a system, so I ran the following command to find foreign packages and some date related infos:

> pacman -Qmi

Check the output against the list of affected packages.

Then, you can also grep for those files in various locations: > grep -rl "atomic-lockfile" / --include="package.json" --include="package-lock.json"

> grep -rl "atomic-lockfile" ~/.npm 2>/dev/null

> grep -i "atomic-lockfile" /var/log/pacman.log 2>/dev/null

Don't know if the packages delete themself after they run. I just wanted to provide some basic commands, as all the other infos I found didn't provide any help.

[1] https://md.archlinux.org/s/SxbqukK6IA

Here is how I did it :

Get a list of installed packages originating from AUR using 'yay' :

  yay -Qam > packages_aur.last

Get list from https://md.archlinux.org/s/SxbqukK6IA# :

  curl https://md.archlinux.org/s/SxbqukK6IA/download > compromised.txt

then :

  grep -wFf compromised.txt packages_aur.last

should spit out the packages that are in both files, hence were compromised at some point, I guess.

Thank you for this! I only had two on my system, thank goodness. I have uninstalled both.

libgdata 0.18.1-5 qt5-3d 5.15.18-1

Have you checked the install date? I'm not sure which are the compromised version numbers, but if they were installed before June 10 you're probably safe. (I think libgdata 0.18.1-5 used to be on the main repos in February, and has recently been downgraded to AUR, so you may be fine).

Only packages from AUR have been compromised, meaning a normal update `pacman -Syu` won't install them, they'll only be installed by `makepkg` or AUR helpers (such as `paru`, which asks you to review the PKGBUILD diff).

Also, if you had installed a compromised version, uninstalling the packages is not enough, you'd probably need to reinstall your system and rotate all credentials. More info here and on the linked blog: https://discourse.ifin.network/t/400-aur-packages-compromise...

These were installed before June 10th I am almost certain. I will read that link just to be safe!

Looking at my pacman cache both of these versions existed on my system before June of this year so I think I am okay.

I love that even when trying to put malware into Arch Linux AUR, the malware is still distributed through NPM. Legendary platform.

The attacker used at least three Node dependencies in the attack, just checking for atomic-lockfile is not enough. The names js-digest and lockfile-js were also used, and at some point the attacker switched to bun instead of npm.

Also see: https://github.com/lenucksi/aur-malware-check

How did emacs-magit got affected? It does not have any javascript to my knowledge