HackerNews Digest

The page highlights Helsinki’s Oodi Library as a model for expanding public services beyond books. Alt‑text descriptions show patrons borrowing sewing machines, tennis rackets, swimming‑pool passes, and receiving assistance with digital health records, pension portals, CV writing, and job applications. The library’s broader role is framed as reinforcing democratic participation by providing practical tools and knowledge that empower citizens. Additional image captions reference a range of cultural and scientific topics—Van Gogh’s “starry night,” literary interviews, physics explanations, and historical subjects—illustrating the diverse content available through the library’s digital platform. Overall, the material underscores the library’s function as a community hub that facilitates skill development, access to resources, and civic engagement.

The article argues that many web developers misunderstand Cross‑Origin Resource Sharing (CORS), using a recent Zoom vulnerability as a case study. Zoom runs a local web server on http://localhost:19421 that receives requests from its website; instead of standard AJAX calls, it loads an image whose dimensions encode status information to bypass CORS. The author corrects the claim that browsers ignore CORS for localhost, noting that Chrome and other browsers enforce CORS headers for local ports (e.g., in typical Create‑React‑App setups). A proper implementation would expose a REST API on the local server with an `Access‑Control‑Allow‑Origin: https://zoom.us` header and employ a Content‑Security‑Policy to block iframe rendering. The author stresses that exposing privileged functionality to any origin is unsafe and that CORS should be used rather than hacky workarounds. The broader point is that confusion over CORS and CSP persists across experience levels, leading to insecure patterns that appear in open‑source examples and other products besides Zoom.

- **Model difference**: epoll uses a readiness model (kernel notifies when I/O can be performed), requiring a separate read/write syscall after each event; io_uring uses a completion model (kernel notifies when I/O has finished), allowing the operation itself to be submitted and completed via shared ring buffers. - **System‑call overhead**: epoll needs epoll_ctl once, then epoll_wait plus a read/write pair per I/O (≈2 syscalls/event). io_uring incurs a one‑time ring setup and a per‑batch io_uring_enter call; with SQPOLL the steady‑state cost can be near zero. - **Batching**: io_uring can submit and reap many operations in a single syscall, dramatically reducing context switches when handling many connections. - **Zero‑copy options**: buffers can be pre‑registered with io_uring_register_buffers to avoid kernel memory copies; network sends can use IORING_OP_SEND_ZC (kernel 6.0+). - **SQPOLL trade‑off**: enables kernel‑thread polling of the submission queue, eliminating syscalls but consuming CPU while idle, with an idle‑timeout fallback. - **Error handling**: results and errors are delivered asynchronously in completion‑queue entries (cqe->res) rather than as immediate return values. - **Practical recommendation**: on Linux 5.1+ (released 2019) io_uring is the preferred async I/O interface for new projects; epoll remains only for legacy kernels older than ~7 years.

Loupe is an open‑source iOS/iPadOS app that enumerates the device‑fingerprinting surface by reading raw values from public iOS APIs—the same data any third‑party app can obtain. It displays these values without aggregation, hashing, or transmission, and only exports data if the user explicitly chooses to do so. Signals are categorized into three tiers reflecting access cost: Passive (available without prompts, e.g., locale, time zone, screen size, battery state), Needs Permission (trigger iOS permission dialogs, e.g., contacts, photos, location, calendars), and Advanced (side‑channel techniques such as canOpenURL probing and Keychain persistence across reinstalls). The project is built primarily with AI‑generated code, requires Xcode 26+, and uses folder references for automatic Swift file inclusion. A macOS build exists but is not yet polished. The source is released under the MIT License, while branding assets remain © Mysk. Loupe is intended to raise awareness of passive data collection and is linked to Psylo, a privacy‑focused browser.

TownSquare is a lightweight, real‑time presence layer that can be added to any website by inserting a single