For those wondering what CHERI is: https://cheriot.org/cheri/philosophy/isa/2025/11/19/cheri-or...

Context from the homepage (https://flow5.tech):

An analysis tool for planes and sails operating at low Reynolds numbers

flow5 is a potential flow solver with built-in pre- and post processing functionalities. Its purpose is to make preliminary designs of wings, planes, hydrofoils and sails reliable, fast and user-friendly.

With so many things being called Flow these days, this one is probably the most fitting.

Beyond hover detection causing the app to preload (TIL that's apparently a thing? Can anyone confirm?), another case I've seen is trying to slide up to unlock but accidentally triggering the lock screen camera for a millisecond or two, which also causes the indicator to linger for a few seconds.

edit: Is this actual "hover without touching screen", which is what I was shocked about, or is this more like "finger passes over the icon while swiping between pages"?

I too would be interested in such a tool. I've had some luck finding close-enough ICC profiles, but it would be great to dial it in.

In previous versions, you could change it mid-loop. This apparently caused some unintuitive behavior when paired with generators (e.g. `for k, v in pairs(table)`).

I haven't run into this myself, but it does make sense, and eliminating this footgun sounds like a good idea.

They use remote attestation based on SGX. So, assuming SGX can be trusted, yes. See https://signal.org/blog/private-contact-discovery/

and assuming you have a practical way to

- verify the attestation

- make sure it means the code they have published is the attested code

- make sure the published code does what it should

- and catch any divergence to this *fast enough* to not cause much damage

....

it's without question better then doing nothing

but it's fundamentally not a perfect solution

but it's very unclear if there even is a perfect solution, I would guess due to the characteristics of phone numbers there isn't a perfect solution

Well, no - as long as someone you trust is able to do that verification, that's good enough.

I'm in Europe and I see a lot more than that. Apologies for the ugly formatting, mobile:

As part of changing laws in Europe, Meta now offers the option for you to chat with others using third-party messaging apps that have integrated with WhatsApp and that you choose to turn on.

Note: Chats with third-party apps are only available in select regions and may not be available to you.

- You can send messages, photos, videos, voice messages, and documents to end users of supported messaging services that have integrated with WhatsApp.

- Messages or other content you send from WhatsApp to third-party users are encrypted in transit, and WhatsApp can’t see them.

- Third-party apps have their own policies and they might handle your data differently than WhatsApp.

## Eligibility requirements to turn on third-party chats with WhatsApp

- Third-party chats with WhatsApp are only available to users with a WhatsApp account registered to phone numbers in the regions covered by the Digital Markets Act (DMA).

- If you change your phone number to a number registered in a region not covered by the DMA, you won’t be able to use third-party chats on WhatsApp.

- Third-party chats are only available on WhatsApp for iPhone and Android. Third-party chats on WhatsApp are not currently accessible on tablets, web, or desktop.

If you’re eligible, learn how to use WhatsApp with third-party chats in this article (links to https://faq.whatsapp.com/818760060056834?helpref=faq_content)

## Your safety and third-party apps

We care about the safety of our global community when enabling chats with third-party apps. Visit our WhatsApp Privacy Policy for users in Europe for more information.

When you send a message to a third-party app, the phone number registered to your WhatsApp account is available to the third-party app you select. Other people who know your phone number can find and message you from third-party messaging services you've enabled.

Note: Users you’ve blocked on WhatsApp might be able to message you from third-party apps. Learn more about how to block someone in this article.

## Be mindful of the information you share

Before you chat with someone using third-party apps:

- Make sure you know the person you’re chatting with before sharing any personal information.

- Be aware that scams and spam might be more common when messaging with third-party apps.

- If you receive an unwanted message from a third-party chat, you can block the sender from messaging you from the third party.

From massgrave.dev, just below the big heading:

Open-source Windows and Office activator featuring HWID, Ohook, TSforge, and Online KMS activation methods, along with advanced troubleshooting.

Looks like this is the first commit where it was added: https://github.com/mastodon/mastodon-android/commit/a0cbf0fa...

Thanks! It looks like that repo is GPL though, which I respect but isn't going to work for my usage (where I'm trying to build a generic UI toolkit that can be used by all sorts of applications including closed source ones).

It's just two broadcast receivers (one for receiving the push token, another for receiving actual notifications), and one broadcast sender to ask GSF to give you a token. This code is so trivial it's not even worth separating into a library.

Here's how you request a push token:

    Intent intent = new Intent("com.google.iid.TOKEN_REQUEST");
    intent.setPackage("com.google.android.gms");
    intent.putExtra("app", PendingIntent.getBroadcast(context, 0, new Intent(), PendingIntent.FLAG_IMMUTABLE));
    intent.putExtra("sender", FCM_SENDER_ID);
    intent.putExtra("subtype", FCM_SENDER_ID);
    intent.putExtra("scope", "*");
    intent.putExtra("kid", "|ID|1|");
    context.sendBroadcast(intent);

Here are the two receivers:

    <receiver android:name=".PushNotificationReceiver" android:exported="true" android:permission="com.google.android.c2dm.permission.SEND">
        <intent-filter>
            <action android:name="com.google.android.c2dm.intent.RECEIVE" />
        </intent-filter>
    </receiver>
    <receiver android:name=".api.PushSubscriptionManager$RegistrationReceiver" android:exported="true" android:permission="com.google.android.c2dm.permission.SEND">
        <intent-filter>
            <action android:name="com.google.android.c2dm.intent.REGISTRATION"/>
        </intent-filter>
    </receiver>

The first one is where you get notifications. The parameters you sent from the server will simply be your intent extras.

The second one is where you get push tokens. There will be a "registration_id" extra string which is your token. It may start with "|ID|1|" (the "kid" parameter from the request, not quite sure what it does), in which case you need to remove that part.

You want to refresh your push token every time your app gets updated and also just periodically if you haven't done it in a while. I do it every 30 days.

This is also what UnifiedPush lib to use FCM does (https://codeberg.org/UnifiedPush/android-embedded_fcm_distri...)

Which is documented in this gist: https://gist.github.com/mar-v-in/2a054e3a4c0a508656549fc7d0a...

Coming from the npm world, I see enough code for at least two libraries.

But seriously, write this as a blog post, more people need to know about this, and I'd like to have something "authoritative" to send references to.

Here is a blog post to use the play services, without the proprietary lib and API: https://unifiedpush.org/news/20250131_push_for_decentralized...

And there is this gist for the app side, if you need something to share: https://gist.github.com/mar-v-in/2a054e3a4c0a508656549fc7d0a...

Their comment would technically be proprietary code since there's no license alongside it, but grishka wrote the original implementation of the reverse engineered code in that mastodon commit in the first place. So I'd imagine it's free game to use it as a reference (IANAL)

Grishka expresses that the code is trivial. Trivial inventions are not covered by patents. I believe, therefore, that a license for trivial code is not necessary.

But if someone knows better I would appreciate any correction. Legal matters are seldom clear or logical. Your jurisdiction may vary, etc etc.

In case there are any doubts, consider this code and its description public domain.

But then I'm not sure how much code is enough to be considered copyrightable. Is "2*2" copyrightable? Clearly not, because it's too trivial. Where is the line?

A long standing question, I think Joel mentioned such a question once on the Stackoverflow blog.

Thanks, Grishka.

Patent != copyright. You can patent an algorithm (e.g., Adaptive Replacement Caching, which was scheduled to go into public domain this year but unfortunately got renewed successfully) but when it gets to the level of an actual specific implementation, it's a matter of copyright law.

It's why black-box clones where you look at an application and just try to make one with the same externally-observable behavior without looking at the code is legal (as long as you don't recycle copyrighted assets like images or icons) but can be infringing if you reuse any of the actual source code.

This was an issue that got settled early on and got covered in my SWE ethics class in college, but then more recently was re-tried in Oracle v Google in the case of Google cloning the Java standard library for the Android SDK.

I have no idea how copyright applies here. StackOverflow has a rule in their terms of use that all the user-generated content there is redistributable under some kind of creative commons license that makes it easy to reuse. Perhaps HN has a similar rule? Not that I'm aware of, though.

This is a copyright question not patent one.

If you need something permissively licensed, I believe microG also has implementation of the notification protocol: https://github.com/microg/GmsCore/blob/cb9be8f682d7649dae23b...

It's Apache 2.

Loading in GTA Online absolutely does not happen once per session. It happens before and after every mission and activity. I am not sure whether it's a full load/was also affected by that bug, but I can certainly tell you that around 20% of my GTAO "playtime" consisted of staring at a load screen.