Virginia Bans Geolocation Data Sales as Privacy Concerns Mount Across Tech World

A Morning Commute, Already Packaged and Sold

Virginia has enacted a law banning the sale of geolocation data, landing alongside a piece by theoretical computer scientist Scott Aaronson describing what he calls an American privacy emergency. Together, the two items have dominated discussion in the Hacker News community on the eve of Independence Day.

The episode also brings word of Alibaba banning Anthropic's Claude Code from its workplace over alleged backdoor risks, a critical Linux security regression that has reportedly been wiping disk-encryption keys from memory since kernel version 6.9, and major releases from the open-source container and photo-management worlds. A philosophical manifesto arguing that running AI locally should be treated as a fundamental right rounds out a dense news day.

Virginia Draws the Line on Location Data — and One Scientist Calls It an Emergency

Virginia has become the first U.S. state to ban the outright commercial sale of geolocation data, targeting a practice that turns routine app usage into detailed mobility profiles. Precise geolocation data — typically defined as accurate to within roughly 1,750 feet — is covered by the law, which carries real enforcement mechanisms rather than relying solely on consent frameworks. A Hunton analysis circulating in the Hacker News discussion describes the categories covered as broader than most observers expected.

The Hacker News thread, which drew 129 comments, surfaces a central tension: data brokerage is fundamentally jurisdiction-agnostic. If data collected in Virginia can be sold by a broker incorporated elsewhere, the protection is incomplete. Proponents counter that Virginia hosts a disproportionate share of U.S. data center infrastructure, giving its regulatory posture outsized industry weight. They also point to California's CCPA, which effectively raised the floor for consumer data handling nationwide because companies with national operations found uniform compliance cheaper than maintaining 50 different regimes.

Scott Aaronson, a theoretical computer scientist at UT Austin known primarily for his quantum computing work, argues in a widely circulated blog post that the U.S. has sleepwalked into a situation where private-sector mass surveillance infrastructure is now structurally resistant to regulation. He draws a parallel to environmental regulation in the 1970s — the moment when governments had to compel companies to stop doing something profitable rather than simply ask. A federal comprehensive privacy law remains politically distant given Congress's current composition, commenters note, making state-level action the primary mechanism for now.

Several commenters highlighted that geolocation data functions as an entry point into dossier-building: a phone's location at 11 p.m. matched against property records infers a home address, which then matches against voter registration and purchase history. The surveillance effect is, in this framing, an emergent property of combining datasets rather than the act of any single actor — making a surgical intervention at the point of sale a logical regulatory target.

A piece climbing the HN rankings at righttointelligence.org extends the privacy argument into artificial intelligence, contending that running AI models locally should be treated as a civil liberties matter rather than a technical preference. Drawing loosely on Third and Fourth Amendment traditions around the sanctity of the home, it argues there is a meaningful difference between intelligence that helps someone think privately and intelligence that requires sharing one's thinking with a corporation as a condition of use. HN commenters are divided on the constitutional framing but broadly accept the underlying premise, particularly as consumer hardware — Apple's Neural Engine, Qualcomm's NPUs — pushes capable local inference within reach of ordinary users.

Alibaba Bans Claude Code, Signaling an AI Tools Cold War

Alibaba has instructed employees not to use Claude Code, Anthropic's AI-assisted coding tool, citing alleged backdoor risks, according to a Reuters report that scored 116 points and drew 72 comments on Hacker News. The surface headline, observers note, is the least interesting part of the story.

Alibaba is one of the world's largest technology companies, with annual revenue exceeding $130 billion, and it operates its own competing AI coding assistant called Tongyi Lingma. At least two distinct readings of the ban are in play. The first is a security concern: Claude Code, like most AI coding assistants, sends code context to Anthropic's U.S.-based servers for inference. From a Chinese corporate security perspective, any tool that transmits code snippets to a server controlled by a U.S. company represents potential legal exposure under American law — including FISA and National Security Letter authority that could compel disclosure — regardless of Anthropic's own conduct. Experienced security practitioners in the HN comments note that the threat model is coherent even if the word 'backdoor' is doing considerable rhetorical work. The second reading is competitive: removing an external alternative accelerates internal adoption of Alibaba's own tools.

China's Cybersecurity Law and Data Security Law add a regulatory dimension: depending on which teams and projects are involved, transmitting source code outside mainland China's networks may create genuine legal compliance exposure for Alibaba entirely apart from any concern about Anthropic specifically.

The HN discussion raises a pointed counterfactual: a major U.S. company banning a Chinese AI coding tool would likely be framed as standard cybersecurity hygiene. Both readings, commenters argue, are simultaneously valid — and the result is a structural bifurcation of the developer tools market along geopolitical lines, producing two separate ecosystems that will diverge over time in capabilities, training data, and architectural assumptions. For Anthropic, the implication is a meaningful ceiling on addressable market; a potential commercial response would be investing in on-premise deployment options that keep code off U.S. servers, though that significantly changes the economics of the product.

A Year-Old Linux Flaw Has Been Leaving Encryption Keys Exposed

Since Linux kernel version 6.9, shipped in May 2024, the LUKS disk-encryption suspend feature has reportedly stopped wiping disk-encryption keys from memory when a system is suspended — a regression that has sat quietly in production systems for more than a year before being prominently flagged on Hacker News via a Mastodon post by Ingo Blechschmid. The post drew 487 points and 209 comments.

The security implication is concrete. Cold boot attacks, demonstrated convincingly in academic research as far back as 2008 by a Princeton team, exploit the fact that DRAM retains data briefly after power is removed — longer still at low temperatures. An attacker who obtains a suspended laptop, chills the RAM, and extracts it quickly may recover cryptographic key material. Clearing encryption keys from memory on suspend is precisely the mitigation designed to close that window; the regression reopens it.

Anyone running Ubuntu 24.04 or later, Fedora 40 or later, or a rolling distribution such as Arch has almost certainly been running an affected kernel. The attack requires physical access, which limits exposure primarily to targeted scenarios — border crossings, hotel rooms, corporate espionage, state-level adversaries — rather than mass exploitation. The recommended immediate mitigation is to fully power down rather than suspend when operating in sensitive environments. Because it is a regression rather than a novel flaw, a fix is expected to be relatively straightforward once the offending commit is identified, but the distribution pipeline means most users will remain exposed until patched kernels arrive through their normal update channels.

Separately, a project called crustc — the entirety of the Rust compiler translated to C — earned 292 points and 57 comments on its own merits. The practical motivation is bootstrapping: having a C translation of the Rust compiler means the entire Rust toolchain can be built from a C compiler, which is more widely available and auditable on constrained or unusual platforms. The HN discussion connects the project to the broader 'bootstrappable builds' movement and to Ken Thompson's 1984 Turing Award lecture, 'Reflections on Trusting Trust,' which laid out the philosophical problem of a malicious compiler that inserts backdoors invisible to source code review. crustc is, in that framing, an answer to that challenge for the Rust ecosystem.

Podman, Immich, and Safari MCP Signal a Maturing Open-Source Stack

Three significant developer tools releases arrived in a single day. Podman 6.0.0 topped the batch with 550 points and 216 comments on Hacker News. The container management tool has been positioned as a Docker alternative — particularly in enterprise Linux environments where Red Hat's influence is strong — since Docker, Inc. changed its Desktop licensing terms for enterprise use in 2022. Podman's security advantage has always been its daemonless architecture, which avoids running a persistent background service as root; version 6.0 appears to close the gap on user experience, with HN commenters noting substantially improved CLI compatibility with Docker commands, lowering the switching cost for existing teams.

Immich 3.0, a self-hosted photo and video management platform, drew 448 points and 227 comments. The release describes a fundamental architectural rethinking rather than a feature increment, with changes to the mobile sync architecture and underlying storage management system. Immich has grown from a side project to one of the most-starred self-hosted applications on GitHub in just a few years. Its trajectory reflects a broader self-hosted software renaissance driven by privacy concerns, distrust of cloud services' longevity — a concern sharpened by years of Google product cancellations — and falling hardware costs.

Apple's WebKit team released an official Safari MCP server, earning a more modest 113 points but carrying significant technical implications. The Model Context Protocol is emerging as a standard for how AI models interact with external tools; an official Safari implementation means AI coding assistants can directly inspect pages, run JavaScript, and read console output through a standardized interface. Apple's deliberate approach to adopting external standards suggests the company views MCP as durable, a signal likely to accelerate the protocol's adoption across the broader developer ecosystem.

Also worth noting: Marijn Haverbeke — creator of ProseMirror and CodeMirror, whose work powers rich text editors at Linear, Atlassian, and the New York Times — announced a new in-browser rich text editor called Wordgard. The project scored modestly at 33 points and 10 comments but warrants attention given the author's track record. And Manticore Search reported a 14x speedup in embedding generation by rebuilding its ONNX inference path through batching strategy improvements and more efficient use of SIMD instruction sets — a concrete benchmark relevant to anyone building applications that rely on dense vector search, where embedding generation latency is typically the bottleneck.

Open Source Delights, a Cyborg Beetle, and a Hard Look at Local AI's Limits

Among the community and open-source stories, Exapunks — a 2018 puzzle game from Zachtronics in which players write code for tiny agents to solve hacking-themed problems — is enjoying a resurgence of appreciation, earning 301 points and 101 comments. Zachtronics has since closed as a studio, lending the community discussion a slightly elegiac quality. John Salvatier's 2017 essay 'Reality Has a Surprising Amount of Detail,' which argues that every skill contains invisible sub-skills unknowable until attempted, resurfaced with 284 points and 107 comments — one of several pieces on the epistemics of hands-on knowledge that HN communities reliably rediscover. A Great Salt Lake water tracker offering accessible, engaging visualization of flow data into a lake that has reportedly lost roughly two-thirds of its surface area over the past century also generated substantive commentary from hydrologists and Utah residents discussing entrenched agricultural water rights.

In robotics, a team published research in Nature describing a living beetle outfitted with a waterproof suit and electronic controls enabling it to both walk on land and dive underwater. The project earned 50 points and 20 comments; the engineering achievement centers on achieving aquatic-to-terrestrial locomotion transitions in an extremely small system, with the biological platform solving power-density problems that challenge purely synthetic microrobots.

The day's most substantive debate, however, concerned the 'Right to Local Intelligence' thesis and the community consensus that local AI inference represents the privacy-preserving path forward. The skeptical case runs as follows: the argument for local AI being sufficient depends on which tasks actually matter. For bounded, well-defined tasks — code completion, document summarization, personal writing assistance — local models perform credibly. But frontier model capabilities compound in ways local models cannot easily replicate, not just because of parameter counts but because of training data freshness, multi-modal capabilities, and proprietary training data unavailable for open model development. If the most economically valuable AI tasks require frontier-scale capability, local inference is a complement to cloud inference rather than an alternative — and the most sensitive intellectual work goes to the cloud by default because that is where the capability lives.

A further complication: a local model is a static artifact. It does not update; its safety properties, knowledge cutoff, and alignment characteristics are frozen at download. Cloud inference providers can update continuously. Open-weight models are also more vulnerable to adversarial attacks specifically designed to exploit public weights. Two concrete signals will determine which view proves correct: whether the open-weight model ecosystem produces models that perform competitively with frontier models on real practitioner tasks — not benchmarks — despite persistent hardware improvements; and whether U.S. and EU regulators treat local inference differently from cloud inference, which would create a legal floor supporting the local AI movement, or equivalently, which would reduce the local advantage to pure privacy alone.

A Correction, a Security Warning, and the Common Thread

The hosts of the Intellegix HN Daily podcast used their closing segment to issue a correction to a claim made on the May 18th episode, in which the show stated that Ukraine had struck Russian ships in the Caspian Sea. That claim was wrong: the Caspian Sea is landlocked and deep inside Russian territory, and no such attacks were reported. The error was acknowledged plainly.

The Linux LUKS regression received a closing emphasis: any listener running Linux with full disk encryption who has updated their kernel since May 2024 is likely running an affected version — kernel 6.9 or later — and should consult their distribution's security advisories. Until a patched kernel arrives through normal update channels, fully powering down rather than suspending a device is the recommended mitigation in sensitive environments.

The thread connecting Virginia's geolocation ban, the right-to-local-intelligence argument, and Alibaba's Claude Code decision is, at its core, a single question: who controls the systems people depend on. Podman 6.0 and Immich 3.0 are, in that framing, not merely developer tool releases but expressions of a community investing in infrastructure it owns. The crustc project — a Rust compiler translated entirely to C for bootstrapping purposes — represents, in the words of the show, 'genuinely extraordinary engineering work for reasons that have everything to do with principle and nothing to do with profit.'