litchralee

joined 3 years ago
[–] litchralee@sh.itjust.works 11 points 17 hours ago* (last edited 17 hours ago) (6 children)

For folks not willing to make the full leap away from QWERTY, there's also Colemak that preserves the common key combos, such as Ctrl C and Ctrl V.

Also, a word of advice: all the keyboard formats which minimize finger reach compared to QWERTY (which essentially maximized finger reach to accommodate mechanical typewriters) will cause poor word prediction on Swype-style virtual keyboards on mobile phones. This is because optimized keyboard formats try to keep words as close to the home row as possible, so many words using Swype will just be sliding your finger left and right over the home row, which destroys accurate prediction. This is why I'm QWERTY on mobile but Colemak on desktop.

Seeing this take shape, I'm reminded of this video by Atomic Frontier about emoji rocket shapes: https://nebula.tv/videos/atomicfrontier-which-emoji-makes-the-best-rocket/

And on YouTube as well: https://www.youtube.com/watch?v=9Pn0rHTpwvo

Humans that successfully visit would be honored as a Discman.

[–] litchralee@sh.itjust.works 10 points 1 day ago* (last edited 1 day ago) (3 children)

IIRC, the IAU's definition of planet -- infamously applied so that Pluto fell off the list of Solar System planets -- requires that a candidate planet be large enough that its own gravity is strong enough to force it into a rough sphere, whatever it might be made of.

So a disc-shaped planet could not ever meet this criteria, because if it were made of something strong enough to remain a disk, then it's too small to be a planet. And if it did exceed the critical size for gravity to make a sphere, then it wouldn't be disc shaped anymore.

But setting that definitional quibble aside, we will focus on sizes and materials that allow a disk shape object to exist and be large enough for humans (or Mario) to visit. So no Wensleydale cheese. If we say that this object is mostly uniform in its mass distribution, then it would have to be the case that for any disc shape (including cylindrical), different points along the surface will be farther or closer to the center of gravity. Thus, inhabitants would experience gravity differently depending on where they are.

Note that we haven't even considered whether the disc is rotating. If it is, then there's a chance that the centrifugal acceleration at some points will completely negate the gravitational acceleration. At such points, one could hop up and off the surface, linger for a bit, and then get pulled back down once the disc has rotated to a position where there's a net force upon you again. Or if the centrifugal acceleration is too strong, it might repel visitors on the surface altogether.

Alternatively, there would be a danger of playing on a trampoline that accidentally crosses into a net-zero gravity region. Here, a double bounce could send someone very high up, only to then plummet back down to their death when re-entering a downward gravity zone.

I have almost no citations for the above, but I thank you for posing an interesting question.

[–] litchralee@sh.itjust.works 0 points 1 day ago (1 children)

Is the Linux kernel a project of the Linux Foundation though? I understood that Linus Torvalds still maintains the kernel under his original authority, and the Foundation's projects are all the ancillary specifications that the kernel should follow and related distros that make use of the kernel.

[–] litchralee@sh.itjust.works 1 points 1 day ago* (last edited 1 day ago) (2 children)

I agree that RPM isn't the primary quality to assess here, but I think angular momentum doesn't really matter either. As a quantity, momentum describes a conserved capacity to store kinetic energy. As in, it could tell us how long the fan would stay in motion when the wind stops blowing. But that's not the objective for a wind turbine, which is supposed to convert lift from the wind to do some work.

At bottom, none of these quantities are the useful metric for what makes a good wind turbine. And that's expected, because we have few details about the fan itself: the blade pitch, stall speed, and fan diameter, to list a few parameters. The only firm detail we can see is the blade count from the picture.

[–] litchralee@sh.itjust.works 16 points 2 days ago

Having conducted technical interviews after managers have screened the candidates' resumes, I second this. Businesses absolutely look at example works, precisely because it's what they care about: it doesn't take a leap of the imagination that if someone has churned out excellent work for hire, that they can do it again once hired on.

It's a bit harder for prospective employers to take someone at their word without works that they can point to, or can succinctly describe said works in sufficient detail.

[–] litchralee@sh.itjust.works 7 points 2 days ago* (last edited 2 days ago)

I'm more in the software side of things, but have worked with hardware engineers that use formal verification before committing to a design. How I understand the point of formal verification is to answer the question: does this implementation satisfy the given specification?

With that in mind, I'm having trouble squaring away my definition with your passage:

I can imagine a scenario where you no longer review the code but a simulation of all the behaviours of the system, perhaps before any code has been written, and then you can trust the output will have accordingly …?

The whole point, I think, of formal verification is to verify a specific, concrete thing. Simulation doesn't seem to be remotely relevant at all, because it is not the thing itself. C'est nest pas une pipe. Likewise, formal verification isn't about stress testing either, such as hardware shock and vibration testing. At bottom, formal is about reducing the thing to its most basic assumptions, and checking those.

If those assumptions turn out to violate the specification, then that answers the question posed earlier. If however the formal process proves that a specific signal within an FPGA will never take longer than 47 ns and another signal always takes longer than 68 ns, then it's provable that those two signals will not cause a race condition when they come together. And this too answers the question.

Given that formal verification is rooted in mathematical proofs, I don't see how LLMs can help there. In terms if making formal easier to use regarding inputs and outputs, LLMs are still a poor fit. To trust an LLM to write or even audit the specification that will be inputted to formal verification, that's adding a very weak link at the very start of a very robust process, essentially negating all the guarantees of formal verification.

As for the output side, I'm not seeing how a yes/no answer from formal could somehow benefit from the mis-confident elaborations of an LLM. Perhaps in the case of a failure result, an LLM can hone in on the exact hardware or software component that the spec violation is occurring. But my understanding is that formal verification software already does that, because that's the obvious thing to identify once an implementation is proven as faulty.

What practical limits of formal verification are there for this?

Formal verification definitely has limits, and one of the greatest limiting factors for its use in the software domain is the fact that compatible software (meaning it can target many platforms, OS, phones, etc) is an utter mindfield to prove correctness for. Just look at memory ordering: x86 and ARM, in the desktop and mobile spaces respectively, behave very different, yet an ideal formal verification would tell us if a race condition could ever arise. We don't have that today, because the test matrix to verify is outside the limits of our computational power, for any nontrivial example.

Adding AI in any current form -- and maybe any future form too -- will not change this gap in what can be achieved by raw logic and induction. Formal is simply unbothered by LLMs, neither helped nor hindered.

[–] litchralee@sh.itjust.works 7 points 2 days ago

BCP 177 consists of: RFC 6540 : IPv6 Support Required for All IP-Capable Nodes

[–] litchralee@sh.itjust.works 3 points 2 days ago* (last edited 2 days ago)

Given that FOSS licenses are premised on copyright, yes, the same ails would still exist: 1) AI washing of licenses (including transforming one license into another), and 2) the vagueness of whether LLM outputs can be copyright, which threatens the validity of a FOSS license upon that output.

The first ail can be seen even without LLMs: the BSD variants have gone through great pains to remove GPL-licensed code from their base repositories. This basically involves reimplementing utilities and functionality from scratch, using only the ideas that are in common with the equivalent GPL code, but never copying that code directly. This is properly considered a reimplementation, which can then be licensed permissively (eg MIT license).

If an LLM were to train on GPL code but the output were licensed with MIT, then that could be a GPL violation because GPL mandates that remixes continue to keep the GPL license.

Maybe you could avoid this fate by limiting the LLM to only train on permissively licensed code. So that it would be permissive licenses going in, and permissive licenses coming out. No GPL problems here. But that brings us to ail #2.

Some jurisdictions have rules against granting copyright for computer-generated works, in the same vein as works generated by non-humans (eg a macaque). If this LLM fell into this situation, then the output is not copyrightable. And if there is no copyright, a license like MIT or GPL simply cannot apply, because its terms couldn't be enforced.

Well, to be clear, the copyright parts of those licenses would be unenforceable. Some parts of the license may still be enforced under a contracts claim. But in any case, the things we refer to as "FOSS licenses" cannot attach to uncopyrightable works (with the possible exception of the CC0 license, which is essentially the absence of any license whatsoever).

EDIT: you did say "consenting projects" and consent is key. If such consent came in the form of a license grant, then yes, that would be enthusiastic consent for the LLM to generate output, which solves ail #1. But for most multi-person projects, getting consent from everyone is difficult or impossible. The Linux kernel is one such example, having so many contributors that some of them are already dead. Death means they cannot consent, but their copyright grant lives on. And so practically speaking, obtaining enthusiastic consent for whole projects is a challenge, which drastically limits the prospects for such an LLM from the very beginning.

[–] litchralee@sh.itjust.works 6 points 2 days ago* (last edited 2 days ago)

There's a fascinating piece of banking history embedded here, since for a fairly long time, the economics of USA banking meant that long-term banking relationships generated the most revenue for the bank. So they would go out of their way to establish new relationships that would hopefully endure for decades, thus keeping the bank in business. This applies even if a small percentage of those attempts would be losses, because the average was still mostly upsides.

Today, the banking landscape is much more transactional, where lots of people have no qualms jumping ship to an online bank. Sure, not everyone will go through that inconvenience, but enough will that it upsets the prior calculus that prioritized long-term relationships to achieve long-term value. That of course means that there's less upside to extending a $1k unprotected credit line and all the same downsides. Hence, credit issuers are more stingy now than in the past.

The obvious problem that this exacerbates is that people who never had access to banking have poorer chances of ever getting served once they do need banking services, because that first account needs to meet strict credit approval requirements or whatever. The very fact that a steady 4.5% of American households can't meet the bank minimum balance requirements, while "non bank" services like payday loans and buy-now-pay-later are on the rise, is a reminder that opportunities from yesteryear are disappearing rapidly, concentrating to those that already have plenty of opportunity.

Past institutions and past people did what made sense at the time, but it's quite clear that in the present, the situation is not serving the people's needs. The corporate desire to grow bank market share or shareholder value is precisely the opposite of what sustainable banks should be doing: right-sizing their scope to match what their clientele can afford. If a bank can only stay in business by having a $1500 minimum monthly balance, then they should close and a smaller, nimbler bank or credit union that only needs $400 to be sustainable should take their place. Banks grew to match the needs of the public. If the public's needs have changed, so must they.

[–] litchralee@sh.itjust.works 28 points 3 days ago* (last edited 3 days ago) (2 children)

IIRC, there's a difference between entries expiring from a credit report, and whether a debt is still legally collectable. If the holder of a debt can prove the debt is still outstanding, or has it ratified as a court judgement (and renewals the judgement, as local rules may require), then it may still be pursued once someone returns to the personal jurisdiction of the court.

The thing is, though, since the original creditor will have wanted to get something rather than nothing, they may choose to sell the debt to a debt collection service, conveying the legal rights to pursue the debt. In return, the original creditor gets a fraction of their money back. But even the most prodigious debt collectors may give up and sell the debt to someone else, for pennies on the dollar. As the value of the debt keeps shrinking, those fixed costs to keep the debt collectable (eg maintaining paperwork, renewing a judgement) become disproportionate and thus skipped.

At the very end of the chain are debt collectors with such a huge catalog of bad, uncollectable debt, but they're hoping they can schmooze or bamboozle the debtors into paying one day. As with all debt collectors, they have no right to add renewed entries to someone's credit report, so the debt is essentially in limbo: unenforceable yet still on paper.

 

A few months ago, I was gifted a non-operational DEC VT320 serial terminal. This is a 80s/90s text-only CRT monitor, which was only displaying a thin vertical line rather than a proper picture. I've done some electronics repair in the past, but nothing this old or involving a high-voltage tube. But I figure that it would make for an interesting project over the summer, whether or not I can recover it. If nothing else, it is quite a retro talking piece.

Fortunately, DEC -- aka Digital Equipment Corporation-- made a lot of these things, and also published troves of service information, which was the norm back then (#RightToRepair). Among the documents that can be found online included the schematics, which would be of incredible aid. That said, the quality of the scan is pretty poor, and it took quite a bit of cross-referencing of component identifiers with the parts list to confirm what couldn't be read.

Before opening up the monitor, I did some preparatory research, to identify areas which would be worthwhile to investigate, and also to make sure I'm not going to shock myself in the process. My findings showed that because the CRT was able to display something beyond a single dot in the center of the screen, the issue would not be in the high-voltage generation circuitry, but rather the downstream circuits. Specifically, in the horizontal deflector path; this explains why the only image is a vertical line, because horizontal control was lost.

Using the field replacement guide, I got the monitor open and then discharged the anode using a screwdriver attached to the ground strap. There was no spark or sound, which can happen if the bleeder resistor was still intact. A good sign as to what's probably still working in this monitor, but I take no unnecessary risks around potentially high voltage.

The innards were reasonably laid out, basically existing as components that adorn the CRT display itself. The PSU, main board, and "arc protection" board were all easy to identify, although the latter was more like a connector than a board. I quickly ruled out the PSU by checking its output voltages, so the issue must be on the main board.

logic board of VT320 from above, unobstructed by the picture tube

It took a while to extract the board, since I didn't want to break any of the 40-year old plastic clips. But once out, I began matching the board to the diagrams and examining for any obvious damage. No obviously blown caps, no evidence of thermal events, no components rolling around on the bottom.

At this point, I stopped to do some very thorough circuit analysis of the circuit diagrams, to absolutely understand what I was going to do. This actually took two tries, since each attempt revealed faults in my understanding, and I had to go back to the thinking chair. This part took a few days, until I finally internalized the circuit's behavior. As it turns out, this wasn't necessary, and I'll probably include it as a later comment, just for posterity.

When I returned to the board, I made a plan to solder some trace wires, to verify my expectations when powered on. And indeed, after reinstalling the board, my oscilloscope confirmed that the H sync signal was intact and the power transistor was functioning as expected.

oscilloscope traces, one showing a square wave pulse for 35 ms with amplitude of 4 volts, and another trace showing a single distorted sine pulse lasting 10 ms with peak amplitude of 200 volts

Narrowing the search, I took the board back out and started tracing the lines on the PCB surface -- it was fortunately only a two-sided board -- and then compared my observations to the schematics. This revealed a difference, where the Horizontal Linearity inductor (H-LIN) was not showing connectivity, despite visibly being attached to the trace.

Closer examination revealed that of the inductor's three legs -- two for electrical connections, one extra for support -- one had developed a hairline fault. This physical damage broke continuity, likely from the shock of impacting something. I made a repair by constructing a wooden splint for physical support, and then soldered over the leg for electrical connectivity.

a tall inductor supported by wood splints, marked as H-LIN

For good measure, I completed the exercise of verifying all other components, which showed that all other resistors, capacitors, and connectors were intact and likely working. And with that, I reassembled and powered on the monitor to see.

monitor displaying: VT320 OK, Firmware and Set-Up Screens Copyright  C 1997, Digital Equipment Corporation

And it works! In total, I probably spent a week on-and-off working on this. I will say that this is a strange machine to have, since I've been able to hook it up to a modern Linux machine and use it as a serial TTY. I even wrote most of the text of this post in vim.

a VT320 terminal with vim open

 

I only learned about this effort today. They seem to document the air protocol and the companion protocol, so that compatible implementations can be written to expand the universe of MeshCore nodes.

I'm not sure I agree with using ZephCore (a port of MeshCore to Zephyr RTOS, apparently initially AI-generated using Claude) as the reference material -- as opposed to directly referencing the MeshCore mainline repo. But nevertheless, it's a good start to formalizing the protocol behavior necessary for an interoperable implementation to those existing nodes in the field.

 

The convention in the USA for old urban centers and new suburban sprawl is to construct a street or road with a crown that drains rainwater to gutters along both sides of the road, then have storm drains to convey the water from the gutter to some nearby creek or tributary. But why?

Wouldn't it be easier to construct the road in a roughly canal shape, so that rainwater drains towards a single V-shaped gutter at the road's center? This would cut the number of storm drains by roughly half, prevent leaves from falling directly into a drain and clogging it, make it possible to clear a drain by driving a streetsweeper over it, and also prevent a clog from flooding adjacent properties, since the road itself can temporarily impound more water until municipal authorities can clear the blockage (whereas side gutters would invariably flood the sidewalk and carry sharp debris that would damage tires entering a driveway).

Furthermore, a center drain can be built once and then retained as-is each time a suburban arterial needs expanding -- "just one more lane, bro" -- whereas side gutters are regularly demolished and rebuilt to accommodate additional lanes. By routing water away from the edges of the road, sidewalks avoid freeze/thaw cycles, and the road surfacing can be continuous from the curb: no more bike lanes in the gutter. As a convenient benefit, the "drop" off at a curb-cut from a driveway to street level would cease to exist.

And where required to improve water quality due to runoff pollution, a center drain can be excavated and rebuilt as a linear stormwater retention pond, where moderate stormwater can filter into the local soil slowly, with a predefined overflow level that will drain to the existing stormdrain pipes. This is already done for both surface parking lots as well as Interstate highways, so it's not an unproven design.

Narrow alleyways in older cities do use a central drain, so I can't see why the idea stops making sense for larger streets and roads. The only drawbacks I can envision are aesthetic -- a neighbor's excessive lawn irrigation would draw a wet line across half the street -- and that the center channel would also carry leaves and wayward soccer balls into the middle.

But even still, that doesn't seem worse than the status quo: gutters attract all sorts of detritus, but it's usually hidden beneath the wheels of parked cars until something punctures a tire. And at least in water-starved California, irrigation runoff deserves to be noticed and called out so that it gets fixed. There may even be some small road safety benefit from having a V-shape channel in the center, since it would unmistakably divide opposite sides of the street.

For larger arterial roads that have trees in the center, this seems like free irrigation and water pollution control. It even works when the center traffic lanes are converted for running a tram or light rail train.

What am I missing here?

 

cross-posted from: https://sh.itjust.works/post/61250326

A crafted MeshCore node name could compromise any Home Assistant instance running meshcore-card as soon as someone viewed a dashboard with that card.

The same XSS (cross-site scripting) pattern appears to be present in MeshCore-Home-Assistant-Panel-v2 and its HACS variant

To be abundantly clear, and the post goes into detail why, this is not a bug in MeshCore but rather in how web dashboards are not properly sanitizing untrusted input. In this case, the untrusted input is via a field that any malicious MeshCore node could send.

Well worth a read and a follow on their Mastodon.

 

A crafted MeshCore node name could compromise any Home Assistant instance running meshcore-card as soon as someone viewed a dashboard with that card.

The same XSS (cross-site scripting) pattern appears to be present in MeshCore-Home-Assistant-Panel-v2 and its HACS variant

To be abundantly clear, and the post goes into detail why, this is not a bug in MeshCore but rather in how web dashboards are not properly sanitizing untrusted input. In this case, the untrusted input is via a field that any malicious MeshCore node could send.

Well worth a read and a follow on their Mastodon.

 

A reasonable overview of the MeshCore architecture and tunable parameters.

Probably the only part I don't agree with is the idea that the companion/repeater dichotomy is an inherent part of the MeshCore architecture. I don't believe it is, although it's certainly part of the practical implementation. That is to say, if someone wants to use MeshCore purely as a private point-to-point link, then they can jettison the motions of companions and repeaters entirely. As a person to person mesh network, though, companions and repeaters are essential. The distinction I'm trying to draw is that MeshCore can be a lot more than text messages sent amongst friends.

While reading, the explainer for the three-tier t delay seemed especially analogous to me to how circuit breakers are arranged: a nearby power strip might have a fast-tripping 15 amp thermomagnetic breaker, the upstream main panel might be using a 20 amp curve B (moderate trip rate) thermomagneric breaker, and the utility might be using a magnetic 400 amp breaker. By their nature, thermomagneric breakers will handle localized faults that are 3-5x the rating, while the utility's magnetic breaker will trip precisely at 400.1 amps, to protect line-side equipment. Whereas if the utility breaker tripped first, it would unnecessarily black out a whole neighborhood.

Also observe that MeshCore's "flood-then-direct" behavior is identical to that of Ethernet (ie unknown unicast, then unicast), except that Ethernet frames do not get appended with the network path as they progress, which is akin to the postal service where letters arrive at their destination but with no indication of the routing. Accordingly, the MeshCore sender necessarily reserves space to store the mesh route, choosing a tradeoff between node-count (up to 64) or granularity (up to 3 bytes per repeater). This seems complex, but just like with the tax code, complexity is necessary to handle every reasonable scenario.

I will also reiterate the ongoing bug in MeshCore's encryption, which is the use of AES-ECB in the year 2026. Although it's AES-256, ECB has been a known encryption vulnerability for decades and should not have been used in the MeshCore spec. Meshtastic appears to have avoided this particular foible.

Note: the author's blog mentions in the About page that some AI is used to assist in his writing.

 

Background: I spent 40 minutes typing up a reply to a different post, but decided that it ran on for too long. I'll include it at the bottom, but I'm curious to know how much cash is still used in this country.

Certainly, a like-for-like Giro (Europe) system doesn't exist in the USA, with ACH, checks, and Zelle almost filling the void -- albeit incompletely -- which I suspect is responsible for the remaining cash utilization. But is that right? Is cash only used for when there isn't another option? Or is it a matter of consumer preference?

I can understand tipping in cash, or paying for a Craigslist purchase in cash. But maybe I'm missing another dimension? Do some folks pay rent in cash? Or taxes? I'm genuinely curious, but please make sure not to dox your finances in the comments.


My original comment

It's annoying when they get suspicious of a 25k USD withdrawal for instance (even if you managed to prove the purpose of such a withdrawal, it remains at the banks discretion whether they'll approve the transaction).

Let's break this down into multiple points:

  1. Suspiciousness of a 25k USD cash withdrawal
  2. Suspiciousness of a $25k USD electronic or check withdrawal
  3. Necessity to "prove the purpose" of any withdrawal
  4. Bank discretion and considerations regarding withdrawals
  5. Necessity of approval by the bank

I don't believe any of these five points are actually issues. As background, cash withdrawals within the USA are still very commonplace, as the country is fairly rather cash-centric when it comes to businesses, due in part to the lack of a system like Giro (Europe) that has both low, fixed transfer costs and can be sent or received by third-parties. The Federal Reserve's ACH system requires established relationships between accounts, whereas Giro does not. Debit card systems aren't a replacement for Giro either. Zelle (USA) is closer, but still isn't quite as full-fledged. Hence, businesses often deal in cash, pay employees in cash, and consumers pay other individuals in cash (eg buying an automobile).

To that end, for point 1, $25k as a cash withdrawal is not a daily occurrence but it does happen. I can't really think of ever paying for a private party used car by check, and such a cash-heavy transaction is often performed at the buyer's bank, so the seller is assured that the cash is good. In this setting, requesting to withdraw $25k cash is ordinary and mundane, if done very rarely. I doubt even prolific car buyers have this problem, but would be open to hearing evidence otherwise.

For point 2, electronic and check withdrawals have even less suspicion than cash, because they always leave traceable evidence. Money laundering concerns are reduced because the entire money trail can be reestablished later, whereas as cash can easily disappear or be "forgotten". To that end, the suspicion isn't about the cash amount but the source and destination. Even a $1 million check is not suspicious, if it's coming from a law firm's client account to a client's personal bank account. That is, again, a thing that happens fairly regularly. More down to earth, people can and do pay housing deposits by check, and property taxes are often drawn electronically. When one or both accounts to a transaction is prominent and established, there is a low probability of money laundering.

Point 3 is often though to be an issue, due to confusion about regulations for bank clerks on when to file a Suspicious Activity Report (SAR). Bank tellers are required to follow Federal Reserve regulations that aim to prevent abuse of the American financial system for money laundering. An SAR must be filled in whenever the teller: a) thinks money may be laundered, or b) the transaction is above the bank's or regulation's fixed amounts. The latter is often pegged at $10k, so this is where people think that it's disallowed to withdraw over $10k. This is not correct.

An SAR is something the teller fills in, and to do that, they might ask the customer some questions about the transaction. For the grand majority of people, the purpose is quite simple: cash purchase of a car, housing down payment, loan for a friend. Would the teller know if the customer is lying? Nope, not at all. But the SAR forms part of a trail of records, so that money laundering investigators can trace funds in the future. But note that the clerk can fill in an SAR for any type of transaction, including checks, and don't strictly need the customer's truthful answers (or any answers) anyway. An obligation to fill in an SAR does not prevent the transaction from going through. It's a speed bump, not a stop sign.

As for the actual stop signs, that's what point 4 covers. A bank obviously cannot allow a withdrawal if it would exceed the customer's balance, or if they don't physically have enough cash, or if the withdrawal is not authorized (ie not named on the account, or PIN not known), full stop. But other situations may arise where the withdrawal must be delayed, either for the bank's own convenience or because the account agreement specifically requires certain holdings times.

I quickly perused a random account agreement for Wells Fargo and the Available of Funds section describes that new accounts (less than 30 days old) will have elongated hold times for withdrawal against newly-deposited funds. This is applied in a first-in-first-out fashion, so only fully-draining the account would incur the longer hold time. In other cases, the bank may take more time but is required to inform you of that, and provide a definite date for when the withdrawal will clear. This verbiage does not distinguish cash vs non-cash, so they're within their rights to delay a check, as long as they obey their own agreement. If this is not tolerable, find a different bank.

Finally, this also gives us some insight into the default behavior for banks subject to Federal Reserve regulations, which is point 5. A bank may not deny a withdrawal of unencumbered, unheld funds (cash or otherwise), except when the bank has actual knowledge that the withdrawal definitely is for laundering. It is, after all, not their money: it belongs to the customer and they are just the regulated custodian of it. A bank can certainly advise a customer not to fall for a pig-butcherint scam, but they cannot block the customer from obtaining their own money back out. They can, as described earlier, apply a temporary, finite-time hold on the funds, but that's it.

To my knowledge, there is no Fed-regulated, FDIC/NCUA bank or credit union that requires pre-authorized approval to access a customer's own funds. I am open to hearing evidence to the contrary, but I don't believe such a thing exists. How would they even stay in business? To be clear from point 4, a bank can certainly ask for a few day's notice to prepare $50k in new $2 bills. But that's easy enough: just call the bank and verbally request the withdrawal, then collect it in-person days later.

Who is disadvantaged by this? Mostly money launderers and con artists trying to abscond with their scam proceeds. But I'd be remiss if I didn't also mention rich people that prefer to suddenly go on vacation and pay for everything in cash. But the system is designed to be no obstruction to those that plan ahead, or are dealing in such small amounts that it's not a big issue. Normal everyday people all share the costs of money laundering, so it's not fair to disadvantage them just so rich people and scammers aren't inconvenienced by their inability to plan ahead. They don't even have to plan ahead: just keep a few racks in the safe.

It is to me, frankly, a non-issue to withdraw money for me or anyone in the working or middle class, because the very issue of being "flagged by US banks" just rarely even a speed bump. And the rich folks have private banks that will gladly give them inordinate amounts of cash to spend.

What exactly is the problem here, specifically?

 

What can be done

The most glaring problem with MeshCore is that the maintainers do not openly communicate vulnerabilities. Users are left without knowledge of any problems, unable to judge whether to trust MeshCore with their private communication.

 

Here is the thing about open source, Andy: it isn't yours to fence. You don't get to ride a community's goodwill into a USPTO filing and a paywall. You don't get to turn "we built this together" into "I own this, pay me." That isn't a pivot. That's a rug pull dressed up as a business model.

And here is the thing about the "license check" you shipped: it is a 32-bit djb2 hash of the device's Android ID, XORed with the four ASCII bytes MCPP, hex-encoded. That's it. Thirty-two bits. Less entropy than a decent ZIP password. A first-year CS student could break it. You used Claude to generate the code. We used Claude to read the code. It took 19 minutes. The receipts are one click away.

 

CLAUDE CODE JUST RICKROLLED ME. I'm working on a project where part of it will involve videos, and in building out the project it created a dummy page, with made up content (relevant to me!) with two video links pretending to be something else and BOTH WERE RICKROLLs.

Note: I'm using a broad definition of "programmer" to include HTML generation, and a broad definition of "humor" that includes Rickrolling. Together, I think this is appropriate for c/programmerhumor. Mods, please remove if not correct.

 

The money quote:

VTA buses and light rail carried 30,000 people to and from Levi's Stadium, according to the agency. That was 5,000 more than they anticipated and "far surpassing" ridership records set when Taylor Swift played there in 2023.

 

As background from the Wikipedia page, the Anaheim Transit Network (ATN) was established as a city-sponsored non-profit in 1998 to operate bus lines around the Disneyland resort in California, with private funding from the various hotels in the area to run this public bus system. These hotels are obliged to operate or pay for shuttles to Disneyland as part of their development agreements with the city, presumably to avoid untold amounts of automobile traffic.

As the linked press release says, ATN will shutter its operations on 31 March 2026. The area will still be served by Orange County Transportation Authority (OCTA), the county-wide bus service, but looking at the bus lines near Disneyland, coverage seems non-optimal as a replacement to ATN's service.

Other reporting indicates that the City of Anaheim was unwilling to invest further into ATN (despite earlier indications), nor were the hotel operators.

What I find utterly inexplicable is that these stakeholders -- especially the city -- are not recognizing this fact: data from Q3 2025 shows that ATN fixed-buses moved 96,300 average daily riders. From the same document, the USA's heavy rail systems did not exceed that rate, except in the San Francisco, Washington DC, Atlanta, Chicago, Boston, and NY/NJ areas. Basically, ATN was moving metro rail levels of people on buses.

I shudder to imagine how bad this will be for Anaheim once the closure occurs, where workers, visitors, and all other former riders will need to figure out how to move around Anaheim. Ride share automobiles hardly have enough capacity to absorb even a fraction of the prior riders, let alone more automobiles, even if they all carpooled. And seeing as many visitors to Disneyland use the buses to stay at farther hotels to reduce costs, this is a negative attraction. The difficulty of car-seats on ride share made the buses particularly attractive to transport younger children safely.

Each individual hotel operator made an economic choice to not properly fund ATN, but together they will all lose out. Likewise, I don't see how the City of Anaheim is going to make up the transportation capacity around the Disneyland area. Disneyland itself isn't party to the agreement that funds ATN, but they do contract with ATN to shuttle visitors from a far-flung parking lot. But they too will be impacted if staff and guests can't afford to get to the park.

Everyone is going to be worse off, and no one is stepping up to the plate to keep the buses rolling, when it's clearly the obvious thing to do.

view more: next ›