Yep - absolutely agree with you. Just because a devices is locally controllable and has opened up localhost:8080, that doesn't prevent it from also opening a connection to https://badthing.example:9999/ and uploading everything it can find to it. Concepts are orthogonal.

I must admit I haven't got round to doing it yet, but a common thing to do these days is set up a specific IoT network in your house and have it all connect to that, then limit access to the internet for that network. A lot of routers support doing this out of the box now.

HomeAssistant's main strength is in tying otherwise incompatible devices together. Local first is not unique though - HomeKit is local, Matter is local, I don't know much about the Alexa/Google setups but I believe they can be controlled locally too.

Don't get me wrong, Home Assistant is an excellent bit of kit with lots of standardisation and automation. But this article is pushing the wrong part of its strengths - local-first isn't unique. Pick the right ecosystem and it's all local-first anyway.

I have many different smart vendors in my home - Google (originally Nest), Philips, Meross, Aqara, Eve, Ikea, LightwaveRF, Shelly, Eufy, Switchbot...none of them require the internet. All of them can work locally. All of them work in the same ecosystem. Then I have oddities which I use HomeBridge for to bridge the gap - Roomba (older, non-Matter, Worx Landroid (robot lawnmower), Dyson Hot'n'Cool thingy, Logitech Harmony...even plugins for Synology which show the NAS's temperature and allow shutdown. Through the use of HomeBridge, I can draw them into the same ecosystem too. None of this requires the internet.

The meme is completely overblown and quite often you can tell by people that don't actually use this kind of tech. Obviously if I want to control this kit from outside the home then I need an internet connection, and if I want to update any of the kit then I need to download the updates from the internet for that too, but operation from within the house? Just a HomeKit/Matter hub, that's all.

Do these people really think they're hiding Directive 4 from us?

We are only a year out from the murder of a health-insurance executive, so the police are more on edge than usual.

Then we need to threaten such things much more often, so that the cops will eventually get used to it, and relax. ;-)

Debian never tried to kill me through my computer. I'd appreciate it if my car manufacturer made their car as safe as my computer.

Fuck it, I just want a Debian car. Then I won't need to extract bloody vengeance from beyond the grave, as my zombie revenant tracks down the CEO of Subaru, and the rotting flesh of my hands tightens around his throat as payment for the time a popup distracted me.

Some people are busting out "definitions" of "End to End Encryption" but people were already using that as in informal descriptive term long before your formalized technical jargon was made up. Nobody should be surprised if there are mismatches. Have faith in our faithlessness.

I personally view the term as an attempt to call semi-bullshit on SMTP and IMAP over SSL/TLS. In the "old" (though not very old) days, if you sent a plaintext email (no PGP!), some people would say "oh, it's encrypted anyway, because the connection is encrypted between your workstation and the SMTP server, the connection from there to some SMTP relay is encrypted, the connection from there to the final SMTP server is encrypted, and the recipient's connection to the IMAP server is encrypted."

To which plenty of people, like me, complained "But it's still plaintext at every stop where it's stored along the way! You should use PGP, because then, regardless of the connection security, or lack of security on all the connections, it is encrypted end to end. Never trust the network, baby!"

Keep in mind that even when I say that, this is without any regard for key security! When I say E2E encrypted, it is implied that the key exchange may have been done poorly/incorrectly, mainly because few people really get to be sure they're not being MitMed when they use PGP. You can exchange keys correctly, but it's enough of a PITA that, in the wild, you rarely get to. You usually just look up their key on some keyserver and hope for the best. Ahem. And I say "usually" as if even that happens often. [eyeroll]

Indeed, every time I hear about some new secure messaging app/protocol, the first thing I wonder is "how do they do key exchange?" and I'm generally mistrusting of it, by default. And sometimes, I'm unpleasantly unsurprised, err I mean, cynically confirmed.

But anyway, if my E2E definition matches yours, great! And if it doesn't, well, that's ok and it's why we descend into the dorky details, so that we can be sure we're both talking about the same thing.

Should you choose to believe the gossip, this is apparently being seen as a good thing amongst Apple's staff.

Seems to be a case of the Gene Wilder's Wonka scene "oh no, stop!" while doing nothing to actually stop it.

Sorry - as a full-blown human-caused climate change believer, I am also old enough to remember being told that we were in an inter-ice age era and that it would end in my lifetime. I'm in the UK, and I clearly remember a school textbook with drawn pictures of Trafalgar Square fully iced up. This would be early 80s.

Let's not deny that bad information has been given in the past. Bad information is also likely being given today, and will be tomorrow as well. Mistakes happen. I like that this paper has been caught and do not in any way see it as a problem.

I'm seeing a lot of scepticism in the posts, whereas in fact this approach works really well. I'm going to use the example of the Mac - Rosetta 2. I play games running x86 code all the time on my M2 ARM chip, and it's not really noticeable at all. Taking exactly the same approach and applying it to Linux - yep, why on earth not? Already proven to work well.

How many hours of an Asian font designer'(s) time can you buy for $20k? It'd be funny, if it turns out that firing the font company pays off in less than a year.

Commenting to undo an accidental mis-click for moderation - please ignore.

I presume you're referring to the 2008 Chinese Milk Scandal? I'll point out this was something perpetrated by the Chinese industry, not American. It was knowingly covered up with the complicity of the Chinese government to prevent it from embarrassing the ongoing Olympics. Only when the scandal became impossible to cover up did the CCP take any action.

As of December 2025, San Francisco Mayor Daniel Lurie and former Mayor London Breed have both expressed praise for China and the relationship between San Francisco and Chinese cities.

There is zero value in some big scary climate risk number also being disclosed, because A that risk accounted for if you are studying the details anyway and does not help you make a rational decision, because it literally does not affect you beyond the places where it is already baked into the numbers.

If you don't care why the insurance is so expensive or unavailable (e.g. high risk of flooding) then maybe you also don't care about why the house's price is so high (e.g. nice location, good construction, etc). No need to even look at the house. Just treat the whole damn thing as an abstract exercise in numbers.

OTOH, some people might actually care about details. Maybe because they're considering living there?

Once again, Open Source is embarrassed and left behind.

mplayer and mpv still, after all these years, don't have a way to prevent things from working if the content origin happens to be Netflix. It just plays on, stupidly Just Working, instead of breaking the way that Netflix realized their users want it to break.

To be fair your link does say "designed to bypass internet filtering mechanisms or content restrictions", so it sounds like SSH, work VPNs, banking etc. don't count because they aren't designed to get around the porn filters.

You make sense, but there is nothing that is "designed to bypass internet filtering mechanisms or content restrictions" more than SSH and VPNs bypass internet filtering mechanisms or content restrictions, is there? Why would anyone ever design a tool to get around filtering and restrictions, when they can already do that with established mainstream tools such as SSH or VPNs?

I can't believe the bill is intended to never be applied to anything. If we do think it's written in such a way that it never applies, I don't think it'll be litigated that way. Once it's enacted, they're going to say it applies to something, and that something is going to be anything that is secure.