Hacker Newsnew | past | comments | ask | show | jobs | submit | guessmyname's commentslogin

> Compromised Data: Source Codes, CI/CD Pipelines, API Tokens, Access Tokens, Confidential Documents, Configuration Files, Terraform Files, SQL Files, Hardcoded Credentials and more!

And who is going to buy this (useless) data exactly? (half joking)


For many Hacker News readers who check the website every day, this is not news:

• (4 years ago) Japan forces Apple to slightly loosen restrictions on ‘reader’ apps — https://news.ycombinator.com/item?id=28387094

• (3 years ago) Japan pushes for Apple and Google to allow sideloading — https://news.ycombinator.com/item?id=36393809

• (3 years ago) Japan to open up Apple and Google app stores to competition — https://news.ycombinator.com/item?id=36368735

• (3 years ago) Japan to open up Apple- and Google-dominated phone apps to competition — https://news.ycombinator.com/item?id=36370398

• (3 years ago) Apple Japan hit with $98M in back taxes for missing duty-free abuses — https://news.ycombinator.com/item?id=34156235

• (2 years ago) Japan to crack down on Apple and Google app store monopolies — https://news.ycombinator.com/item?id=38773429

• (2 years ago) Japan forces Apple and Google to open their mobile platforms — https://news.ycombinator.com/item?id=40666651

• (2 years ago) Japan enacts law to curb Apple, Google's app dominance — https://news.ycombinator.com/item?id=40671162

• (5 months ago) Japan: Apple Must Lift Browser Engine Ban by December — https://news.ycombinator.com/item?id=44810061

• (5 months ago) Japan Law Will Require Apple to Allow Non-WebKit Browsers on iPhone — https://news.ycombinator.com/item?id=44826077

• (15 days ago) Apple Announces Changes to iOS in Japan — https://news.ycombinator.com/item?id=46307858

• (14 days ago) Apple and Google respond to new Japan smartphone law, including reduced app fees — https://news.ycombinator.com/item?id=46310074

… and more here: https://hn.algolia.com/?q=japan+apple


hmm (thinking) infinite loop, eh?

  $ curl -i -A - 'https://consumer.drop.privacy.ca.gov/maintenance.html'
  HTTP/2 307
  content-type: text/html
  location: https://consumer.drop.privacy.ca.gov/coming-soon.html
  date: Thu, 01 Jan 2026 02:22:37 GMT
  […]

  $ curl -i -A - 'https://consumer.drop.privacy.ca.gov/coming-soon.html'
  HTTP/2 307
  content-type: text/html
  location: https://consumer.drop.privacy.ca.gov/maintenance.html
  date: Thu, 01 Jan 2026 02:22:46 GMT
  […]

I work for a big company (Apple) but I have no idea who Frank is, nor how to sponsor them; and even if I knew them and how to sponsor them, the money would come directly from my pocket instead of Apple’s banking account.

From the article:

  If libsodium is useful to you, please keep in mind that it is maintained by one person, for free, in time I could spend with my family or on other projects. The best way to help the project would be to consider sponsoring it, which helps me dedicate more time to improving it and making it great for everyone, for many more years to come.
The "sponsoring it" links to https://opencollective.com/libsodium/contribute

Hope that helps.


Frank does great work that is critical to many businesses, and should get funded to do it professionally.

However, donating money to an open collective is prohibitively hard for most big companies. Maybe the world should be different (or maybe not, since it would be easy for employees to embezzle money if they could direct donations easily), but that's how it works currently.

AFAICT, there is also no fiscal sponsor, so the donation matching suggested in a sister comment won't apply.

This is why Geomys (https://geomys.org) works the way it does, and why it has revenue (ignoring the FIPS and tlog sides of the business) which is 30-50x of some GitHub Sponsors "success stories": we bill in a way that's compatible with how companies do business, even if effectively we provide a similar service (which is 95% focused on upstream maintenance, not customer support).

I am not saying it's for everyone, or that Frank should necessarily adopt this model, or that it's the only way (e.g. the Zig foundation raises real amounts of money, too), but I find it frustrating to see over and over again the same conversation:

- "Alice does important maintenance work, she should get professionally funded for it!"

- "How does Alice accept/request funding?"

- "Monthly credit card transactions anchored at $100/mo that are labeled donations"

- no business can move professional amounts of money that way

- "Businesses are so short-sighted, it's a tragedy of the commons!"


Anyone who solicits donations should also sell overpriced books of some sort, because it’s often very easy to get even a $500 book approved as an expense where a $5 “donation” causes hell.

With the year prominently displayed, i.e. "20XX Edition", to reflect when it was current. To help people track how long it has been since they dona-bought their last copy. And so purchase documentation explains repeat purchases.

It's a great perspective.

> However, donating money to an open collective is prohibitively hard for most big companies.

You are absolutely correct. However, that's the mechanism that Frank has made available, and that's what the comment I was replying to was asking, so I was just connecting the dots between the question and answer.


Given the increasing obviousness that there's functionally no oversight of NGOs and government funding, perhaps we just need some NGOs and get government grants for these critical services.

While it might be frustrating to see non-viable options presented as ways to fund critical FOSS, it's even more frustrating to see blame effectively being placed on the maintainer; particularly because, if companies like Apple really wanted to fund this work, I'm pretty sure they could figure something out.

Anyway, looking at the model you propose, it seems like the main difference is that Frank just doesn't explicitly say "you can retain my services"? Is that all that's stopping Apple from contacting him and arranging a contract?


> if companies like Apple really wanted to fund this work, I'm pretty sure they could figure something out.

Having spent the last ~6 years in big tech consistently frustrated by the rigidity of the processes and finding clever ways to navigate (see: wade through the bullshit), this isn’t as easy as you’d hope. The problem is that someone has to spend a non-trivial amount of time advocating internally for something like this (a “non-standard process”) which generally means asking pinging random people across finance, procurement, and legal how to deal with it and 99% of people will just throw up their hands (especially in this case because they don’t understand the importance of it). If things don’t fit a mold in these big companies, they fall into the event horizon and are stretched out to infinity.


Couldn’t you just go up your chain to the VP or whatever and use their backing / negotiating at the VP level to organize? It might not work for random projects but if Apple is using libsodium for security this could presumably be pitched as an investment into their own software supply chain.

Bless, 7 years of this at Google razed my soul (to a point)

Filippo is another maintainer, of extremely similar open source software with entirely the same customer base, offering (important) advice to a peer, so I don't think policing his tone is helpful here.

I know who he is and what he does. I think we probably disagree on whether that makes the comment in better or worse taste.

Otherwise, I agreed with him, and am genuinely curious whether the stopping factor here is maintainers like Frank simply not saying "you can email me to retain my services"


> if companies like Apple really wanted to fund this work, I'm pretty sure they could figure something out

A reminder that companies are not a hive mind.

Many people at Apple surely would love to funnel piles of money to open source. Maybe some of them even work in the Finance or Procurement or Legal departments. But the overwhelming majority of Apple’s procurement flow is not donations, and so it is optimized for the shape of the work it encounters.

I bet there are plenty of people working at Chick-fil-A who wish it was open on Sundays. But it’s not ~“blaming the user” to suggest that as it stands, showing up on Sunday is an ineffective way to get chicken nuggets.


The idea that donations are the only way they could fund this work is what I was talking about. I'm sure Apple has various contractors and other forms of employees.

It's like suggesting that Chic-Fil-A really does want to open on Sunday, but the only thing stopping them is customers not telling them they want it open on Sunday.


If you donate via GitHub Sponsors to https://github.com/jedisct1 from an individual / personal account GitHub won't take a cut (or pays for it from their own purse) for any credit card processing fees.

Maybe you don't know this but Apple has a donation-matching program. If you make donations to non-profits through some special internal mechanism, the company will send a donation of equal value (up to some limit). If I recall correctly the limit is 30K USD per person.

Do you have any links or more info about the special internal mechanism? Would need an apple employee to initiate this I assume?

"When you give money to an eligible organization, we’ll match your donations one-for-one, so your $1 has the impact of $2. And if you choose to donate your time, we’ll contribute $25 for every hour you volunteer. Whether you donate time or money, Apple will match your contributions up to $10,000 a year."

https://www.apple.com/careers/us/life-at-apple/benefits.html


That is neat- any idea what they consider an eligible organization?

They're probably using something like https://benevity.com/ to do the vetting, esp. for non US charities.

Any non-profit, or just charitable non-profits (aka 501(c)(3))? Unfortunately, the US does not consider producing open source software to be charitable activity.

It can. There are a number of charitable foundations that support open aource. For example the Python Foundation.

But it is on a case by case basis, and it does take work to get the IRS to accept it.


Interesting. In any case, libsodium's fiscal sponsor (Open Source Collective - https://opencollective.com/opensource) is not a 501(c)(3) non-profit.

One of my email addresses is {MyNameKP}@gmail.com. “KP” were just random letters I picked years ago and they don’t mean anything. I also own {MyName}@hotmail.com. Someone once asked why I don’t use {MyName}@gmail.com, so I went home to try to sign up for it, but Gmail said the address already exists. I figured someone else had it and might sell, so I emailed them. Gmail auto-replied that the address doesn’t exist. Why can’t I register an address that isn’t there? Who knows ¯\_(ツ)_/¯

Aren't email addresses reserved once you delete an account? Maybe that's what happened?

Last name of father and mother, respectively.

  let motherLastName = "Carter Hughes"
  let fatherLastName = "Miller Thompson"
  let childLastName  = "Miller Carter"
  let childFullName  = "Jean Paul Miller Carter"
Or so that is how it works in many countries around the world.

You might ask, —“Why does the father’s last name go first and the mother’s second?”— That’s an old tradition, and it can change whenever enough people in our society agree. As it stands, the father’s family name tends to persist down the family tree, while the mother’s family name often disappears in each generation.

Or so that is how it works in many countries around the world.


Ok. So your children get their grandfather's names.

The names of their grandmothers get dropped.

Only a partial improvement over just dropping the mother's name.


You should have given a more complete example, where the parents themselves have long names to demonstrate that something does have to get dropped when you have children.

Hughes and Thompson were both dropped in their example.

My bad, I misread the parents' names as their full names.


I've been a long time Litte Snitch user. However, these days I'm just using LuLu: https://objective-see.org/products/lulu.html

Why did you switch? Price? OSS? Or does LuLu have compelling features?

It's a mix of everything (in no particular order):

- the author of LuLu is a security researcher; he also wrote "The Art of Mac Malware"

- I already bought two versions of Little Snitch and wasn't willing to pay for the third one

- contacting their support left a bitter aftertaste


> - I already bought two versions of Little Snitch and wasn't willing to pay for the third one

I have probably also paid for three versions. It’s a great piece of software and they do not require upgrades excessively.

But I will try LuLu. I would rather my security software was OSS.


Thank you <3


Same in Safari. It has something to do with the

  :root {
    […]
    overflow: hidden scroll;
    container-type: size;
    […]
  }
in the main CSS file: https://kellett.im/theme/main.css

My spouse and I grew up in Japan and then moved to America. We have never stopped hating the non-illustrated menus that virtually every restaurant offers. There’s no way to know what you’re really getting. The ingredients don’t really tell you much about the dish you’re going to eat, aside from simple things like steak and similar. Sometimes, restaurants also want to be original and write some mambo jumbo in the menu as if I was interested.

https://en.wikipedia.org/wiki/Food_model

I miss Japan so much.


The Americn economy leans heavily on lack of price transparency and opaqueness. You're not allowed to know what you're buying until it delivers, at which point you can either accept it or complain loudly. Adding on a million junk fees and not selling things for prices as advertised is also really important. Food samples would be a huge 180 from all this, culturally speaking.

> at which point you can either accept it or complain loudly.

Or sue.


> I miss Japan so much.

I grew up in the U.S. but this is his I feel whenever I come back from a visit to Japan.


Gordon Ramsey (in one of his failing restaurant tear-down shows) said that pictures on menus meant the food was shit, and to axe them. He's coming from fine dining, of course, but I couldn't disagree more. Sometimes a lot of the menu is illustrated, but the thing I want to try isn't, so I have to Google it and take a chance.

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: