Hacker Newsnew | past | comments | ask | show | jobs | submit | nulld3v's commentslogin

It's not like glass syringes are out of production though? They are still pretty cheap, I get them for $0.50 each from China.

Surely there is a cost to sterilising too.

I've also been dabbling in this recently in an attempt to avoid buying SodaStream syrups (which are on the BDS boycott list).

Tips for working on sugar-free recipes: In some countries (like Canada), soft-drink manufacturers are required to disclose the exact amount of each artificial sweetener they use in the drink. So you can easily grab those numbers from Canadian product listings for use in your own recipes. E.g. 355ml of Diet Coke contains 131 mg aspartame + 15mg ace-K.

Also, aspartame can be difficult/slow to dissolve. It dissolves better in solutions with a low pH and a warmer temperature.


People are always so laser focussed on the latest trendy thing, but why not just boycott all huge corporations/organisations? It’s a much simpler rule that achieves the same thing and you have the added benefit of boycotting companies that haven’t had their corruption uncovered… yet!

I find it more effective to say, I'm avoiding product X for Y reason.

This starts a conversation more effectively with contacts rather than go full large company avoidance which is difficult for people to imagine, let alone act on.

I sympathise with what you're saying though.


This is actually addressed on the BDS movement website

https://bdsmovement.net/what-bds

Effective boycotts work on companies that are large enough to be noticed but small enough for boycotts to have an effect, while divestments and sanctions can be lobbied for larger institutions and governments.

I think just saying something like "why not just boycott all huge corporations/organisations?" can be a bit disingenuous when I think it's pretty well acknowledged that We Live In A Society that makes completely separating yourself from large corporations essentially isolate you from society as a whole


I Googled the BDS Boycott list at a glance...the top link (https://bdsmovement.net/Guide-to-BDS-Boycott) mentions a bunch of companies, including Sodastream. The immediate issue I see is that Sodastream is owned by PepsiCo, Inc. That immediately makes them complicit as well. PepsiCo was also facing a lawsuit regarding a partnership with Walmart for price fixing (https://www.usatoday.com/story/money/2026/01/08/walmart-peps...) until the Trump administration threw it out (https://apnews.com/article/ftc-pepsico-trump-walmart-2cd8b42...).

I bring all this up to say that even if everyone boycotts sodastream, it won't do diddly to the actual folks responsible. I bet the same goes for others on that list. Boycotts also don't usually work in general. Most of the time it takes full on government intervention, lawsuits, etc. to change things.


Boycotts definitely have their limitations, but the Sodastream boycott seems to have had some sort of effect: https://www.timesofisrael.com/victory-for-bds-as-sodastreams..., though whether the intended effect was achieved is debatable...

"West Bank Industrial Zone" lol.

Call it for what it really is (not you, Times Of Israel). A factory inside an illegal West Bank settlement.


We do what we can, where we can, when we can.

Personally, I find it's less about the act (although financially depriving companies of my cash does make me feel good), it's about the conversation the act starts.

And I've seen it work, or help. Some among us will remember the boycott of South African goods during Apartheid.


>Most of the time it takes full on government intervention, lawsuits, etc. to change things.

That's the S.


Isn't this addressed on the same page you linked?

> We must strategically focus on a relatively smaller number of carefully selected companies and products for maximum impact.

My intentionally pick companies that are large enough to be noticable but small enough that they could actually achieve something with the amount of support they have.

If you look the other two letters of "BDS", divestment and sanctions are the strategies for larger institutions and government interventions

https://bdsmovement.net/what-bds


> In some countries (like Canada), soft-drink manufacturers are required to disclose the exact amount of each artificial sweetener they use in the drink

Can you share some links? Neither amazon.ca nor walmart.ca seem to show this.


>BDS boycott list

Looks like a great initiative. Anyone knows about a similar list, but for companies that support Russia and occupation of Ukraine?


BDS has been around since 2005 and organizing on a global scale.

Russia is under heavy sanctions so I doubt there's much more regular consumers can do to boycott if they live in countries compliant with those sanctions.

But there's an app that's (unfortunately) named BoyCat that currently mainly works for BDS. You scan a product and it tells you if it's directly or indirectly tied to a product on the BDS list. I heard they are trying to expand functionality to allow anyone to make and organize around a list

https://www.boycat.io/

TBH this is an idea I've personally wanted to work on for a long time. I think the boycott is an underrated tool for social change and tools that can make it easier to organize around them can be a really powerful force for good


There’s a really simple way that will protect you from any current or future corruptions/profit before people behaviour: don’t buy anything from any large corporations.

If you do this you also benefit from giving your money to real people and not contributing to huge amounts of waste and pollution.


Well done for the BDS attempt ... had to get my Mum to return her Sodastream as she had no idea.

But I have to say, this whole thing is enough to turn me off soft drinks altogether.

Maybe that's the point?

Those bags full of crystals look like something out of Breaking Bad, lol, but I appreciate getting rid of the sugar and caffeine.

Some sparkling water and some cordials or dilutes has to be ~ better!

Thanks for the reminder to switch!


They are constantly attacked because they prevent users from modifying the system configuration, not just app developers.


From the operating system’s perspective, everything is the user. Or everything is an app developer. Depends on perspective. Disambiguating reliably, in a way you’d consider reasonable, is not trivial (and arguably impossible).


Phone-style isolation is more like giving each app a separate user account. With that level of isolation and robust permissions, apps can do very little "on your behalf".


How do you do anything on a computer that’s not via an app of some description? Do you make arbitrary exceptions for the likes of zsh and chmod? How does the OS know that chmod was knowingly run by the user, and not by some “sudo wget” exploit?


> How do you do anything on a computer that’s not via an app of some description? Do you make arbitrary exceptions for the likes of zsh and chmod? How does the OS know that chmod was knowingly run by the user, and not by some “sudo wget” exploit?

I'm not sure what the purpose of the question is, because a unixy command line doesn't use phone-style permissions. I didn't say everything works this way.

If I installed photoshop with phone-style permissions, it wouldn't be able to invoke chmod and wouldn't even be able to access my downloads folder.

(Trying to tighten down a command line shell ends up being a tangent, but the short answer is that zsh itself would need to be trusted and hardened, and wget would not be allowed to run chmod. When it comes to downloading a script and then running that script on purpose, you probably just have to accept that doing so bypasses the permission system. Thankfully I very rarely need to do something like that.)


So you installed a text editor and wanted to edit /etc/hosts. Should the OS permit you to save your changes or not?

Now what should happen if the text editor decides to modify /etc/hosts without your knowledge?


The secure answer is that the OS gives you a trusted file picker and it grants access to that specific file to the text editor.

This works better with a GUI, but you can adapt it to a console too.


> Now what should happen if the text editor decides to modify /etc/hosts without your knowledge?

Pop up a UAC prompt of course. It worked so well for Vista.


I'm not sure I fully understand you. All those OSes try very, very hard to disambiguate between apps and the user itself?


A program touches a system file. Is it due to its own logic, or is it your editor saving a file?


Pretend you’re the operating system for a moment. What does “the user” look like, if not an app doing things?


If a user can do a thing, then an app can ask the user to delegate those permissions to it. And since 99% of users don’t read permission dialogs, the two ideas are completely equivalent. The only way to prevent an app from doing a thing is to make it impossible.


Even if users do read permission dialogues, how many Adobe users out there actually understand what modifying the hosts file means? There can be no informed consent if the person who's meant to consent doesn't have the tools to understand the information.


I think we agree.


You can put pressure on app developers to use standard installation methods that don't give unrestricted access.

Even if users don't read the permission dialogs, you can make one path a lot easier. And you can flag anything too tricky as malware behavior.

OSes are doing a bad job of this, but they could do much better. Linux is making the most progress on various package formats.


Sadly, this issue is systemic: https://github.com/openai/codex/issues/2847


OpenCode has a plugin that lets you add an .ignore file (though I think .agentignore would be better). The problem is that, even though the plugin makes it so the agent can't directly read the file, there's no guarantee the agent will try to be helpful and do something like "well I can't read .envrc using my read tool, so let me cat .envrc and read it that way".


This points out that agentic security flaws are worse than "systemic", they're the feature. Agents are literal backdoors.

It's so bizarre to be discussing minor security concerns of backdoors, like trying to block env vars. Of course the maintainers don't care about blocking env vars. It's security theater.


Thank you for putting in the time to do the research, this is incredibly helpful!


The current largest hydroelectric dam in the world is the Three Gorges Dam in China. It can generate 22.5GW (40% more power than the dam in 2nd place, which is also Chinese).

Since Jan 2024, China has on average constructed 23GW of new solar power every month. So China has effectively been adding a "world's largest dam" worth of solar power, every single month for the last 24 months.


It's nice for extracting data from a page into some structured format (e.g. CSV). Much quicker than trying to whip up a JS script or something.


There are already headsets with decent text fidelity, but IMO the problem is now on the host side. I tried to get an XR desktop env running (Stardust https://stardustxr.org/) on Linux but ran into graphical issues. The Windows ecosystem is much better though.


> the android development kit really is very heavy. compared to `gcc -o main main.cpp && ./main`, it is several orders of magnitude away.

> the jetpack stuff and whatnot - the big android app shops probably do actually appreciate that stuff. but i wish the dev env 'scaled to zero' as they say, but in the sense of cognitive overload.

I tried to build a small binary that listens for events and launches/wakes an app to do some automation. But apparently there's no way to send Intents or Broadcasts from native code? So I need to boot a JVM in the binary if I want it to communicate with anything else on the system!

Of course, you can always communicate via stdio, but that's useless because everything in Android speaks Intents/Broadcasts. Native code can also do raw Binder calls, but nothing on the system speaks raw Binder.


>But apparently there's no way to send Intents or Broadcasts from native code? So I need to boot a JVM in the binary if I want it to communicate with anything else on the system!

There is "am" i think which can be invoked to do this.

However, Termux API exists, and is a nice package for calling other services. They have the scripts interface, which calls the actual app over a socket. Kinda inefficient, but at least the work is done.


Yes, but the 'am' command is just a CLI Java program. At that point, it would be more efficient to just boot a JVM in the binary to avoid the JVM startup cost every time a Intent/Broadcast needs to be sent.

I believe the Termux API relies on a Java/app process that runs in the background to do stuff in response to API calls. Though I guess you get it for free if you already have the API running for other reasons.


I also wish open-source communities would move off of Discord for another reason: Users are limited to joining a maximum of 100 servers.

I've hit the cap and it's driving me crazy. It's really easy to hit it since each friend group, hobby group, gaming community, and open-source community often all have their own servers.


I can barely keep up with 6 semi active discord servers, each with tens of semi active channels... Much less think about doing it with hundreds. More power to you, must have figured out a good notification scheme


I don't really care about the notifications. I just want to read what's in the servers. Lots of communities post their announcements/links/resources in their Discord servers.

It is sometimes possible to view a Discord server without joining it, but it is painful compared to just joining the server.


I am super curious how other people use discord. I’m like you—trying and basically failing to keep up with 6 servers. I just want to watch a power user out of morbid curiosity. I suspect they are also browser tab hoarders, which I’m also curious about.


That limit is per account, right?


Consider applying for YC's Summer 2026 batch! Applications are open till May 4

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: