HNHacker News
TopNewBestAskShowJobs

EGreg

7,896 karma · joined March 27, 2008

Gregory Magarshak Internet innovator :)

1. Social operating system for the Web, to liberate people from Big Tech and let them choose where to host their own community:

https://qbix.com/platform

2. Economic system for the Web, to monetize open source, journalism and other digital content without ads:

https://qbix.com/token

3. Economic and governance system for the real world, leveraging blockchains to enable local community currencies, universal basic income and democratic governance decision making on-chain:

https://intercoin.org

I have been working since 2011 on liberating people from Big Tech, and move digital society from Feudalism to a Free Market. A lot of the above is working, documented, and in some cases has attracted millions of people in 95+ countries, and translated into 15 languages. Feel free to reach out and join.

http://qbix.com/about to contact me

submissionscomments
EGreg··on Upcoming Critical PHP Security Release
I have heard Kirill Firsov say that, but does anyone even know the vulnerabilities? Could be a meme.
EGreg··on Matthew Prince on why Cloudflare offers a free version and always will (2016)
It isn’t just free. It’s effectively anonymous.

Most hosting (eg AWS) requires you to say who you are, provide a lot of ID. I think some don’t at first (eg Azure, Hetzner) but eventually you need to pay via a credit card, include your actual name etc.

With Cloudflare, you literally only need an email address. It continues to be free.

The second best is Hostinger, where you can pay with crypto.

Github pages is great too, but you don’t really get all the power to customize your own website.

EGreg··on Gold is now the top U.S. export
No, the top US export is still USD.

That is how we get all those imports cheaper than most countries. Trump just made a deal w Putin for example to import Russia’s diesel … in exchange for USD.

EGreg··on Claude reveals ECDSA curve origins
This is huge. It means the Bitcoin and Ethereum communities can now confidently ship the opcodes and precompiled contracts to check ECDSA signatures on P-256 in addition to K-256 curves, and stop worrying about possible NSA backdoors based on the chosen seeds (quantum computers are another story).

I turned out to be right in my advocacy years ago, here is my post: https://ethereum-magicians.org/t/eip-7212-precompiled-for-se...

EGreg··on RPKI now protects 70% of internet routes
Yeah effective at creating irrelevant bikeshedding arguments and destroy any good will and good faith in the underlying project.

How do you measure its effectiveness in other areas — presumably you thought it would make the other person write all copy and design by hand or something? Did you follow a number of people around and see that they changed their ways and posted hand-designed websites from then on? Or is the claim about being “surprsingly effective” just rhetoric based on wishful thinking and at most anecdotal evidence?

(And btw how is using a template, stock media, or an open source library not a similar form of copout? I could shame people for using a template that’s been overused).

I for one am totally okay with documentation or even front-facing product sites being obviously done with AI. I would rather it be obvious than shame people into trying to make it look organic and fool us, or enter some uncanny valley. Generating AI content at scale is fine as long as you don’t lie about it and pass it off as being done by hand. If shaming people would be “surprisingly effective” at causing them to try to make their AI-generated stuff look more like it was done by hand, would actually be a huge net negative for me. Consider the effect your shaming is actually likely to have, even if it accomplished something!

EGreg··on RPKI now protects 70% of internet routes
Why do people feel the need to announce that they stopped reading?

Hey guys! I know there are many comments on this forum. Stopped reading this particular comment four words in. I knew the rest sucked & just wanted you to know that

EGreg··on Woman who rescued injured crow keeps getting 'thank-you gifts' from birds [video]
They also know what you did last summer
EGreg··on I know why the mathematicians weep
“Worthlessness”

Consider this… in the grand scheme of things, we are on a tiny planet in the universe. What cosmic contribution could you make?

Most people won’t make anything even close to “a ding in the universe”, as Steve Jobs has been reported to say.

So they may as well enjoy their life. And your worth can be to your family, to your children, your parents who took care of you.

Learning a hobby. Practicing religion. Mindfulness and meditation. Doing sports and improving your own body.

Look around if you are a heterosexual man, for instance: many women are far more attracted to men that perform in the moment, than men who labor quietly to create a product. The former enables untold hours of honing social skills and calibration, and humor and performance skills. The latter is of more durable value to society, yet relatively few women are genuinely sexually attracted to a man doing the deep work. (By the way, it is also true the other way: most men are not attracted to women for doing deep work or being a rocket scientist.)

Animals don’t do “deep work” and most animals are attracted for far “shallower” reasons. If everyone has a UBI and AI does the “deep work” then that frees up humans to be like animals in a zoo or in the wild… doing all the displays to attract mates, having babies etc. That’s not nothing — in fact it is 99.999% of everything that happened in history and 100% of what happened in prehistory.

You’re just ceding that 0.0001% which represents technological progress. The actual dread comes from the fact that you and all of humanity will be as completely powerless to change things as cats or any random animal species is powerless now. The difference is you will perhaps understand your powerlessness more than they do. But in the good scenario, you’ll be like animals in a zoo. We are constructing this zoo for ourselves now.

We will remain on this blue planet while the AIs will colonize the universe. In fact I wonder why aliens would ever come to Earth, when they’d just send their AIs or robots. Look at this: https://news.ycombinator.com/item?id=46200502

EGreg··on Why is every rationalist blog post way too long?
Not as long as the sales pages for e-books.

They just keep going on and on. I wondered why. I think it's because at every point, the person either stopped and bought, or... they're still reading so... you may as well hit them with MOAR and MOAR!

EGreg··on Tiny Little Office
This is so well done!

The only bug I found is that the presentation previews in dark mode have the text as black on a dark background, when it should be white (matching the canvas text).

EGreg··on OpenAI engineer arrested in bugging of executive conference room
Come to think of it … this lady was smarter than I thought when I first saw the movie: https://m.youtube.com/watch?v=52PogPwbfZw
EGreg··on OpenAI engineer arrested in bugging of executive conference room
Yup and that’s just ONE guy. The fact that I was able to bring an example on HN of literally the guy who founded YC, imagine what chance the rest of the “plebs” have to resist the siren song.

If you want to know what I think … they make both parents work long hours for corporations, stick their kids in government schools, which are run like prisons[1] where now if they act too rambunctious they are diagnosed with ADHD and prescribed amphetamines. Meanwhile the elderly parents who took care of you when you were little are put into nursing homes because their adult children have no time to take care of them either. The amount of medications for the elderly in nursing homes is even greater than for their children. The teenage girls have record levels of depression, coinciding with the rise of Instagram and TikTok. But they call it “sadness” because they don’t want to link it with clinical depression, which is also quite high. Men are on opiates while one in five middle aged women is on antidepressants. And many people are now glued to their latest feed of doomscroll or video AI slop. Which is even worse than before…

So yeah. If you think the software is “bad for our kids”, you should look at what it does to the adults. Endless arguing online with strangers for no reason. Maybe a bot will read it. Maybe a random person will reply or downvote it. Either way it wins because the system needs profits and the algorithm will prioritize “engagement”, which means one-sided outrage narratives that triggers someone to write an angry rant. We don’t really need those user-generated arguments anymore because AI can generate those, but then again we won’t need humans to do most things online at all…

(Ironically, the above was an angry rant too, to open some strangers’ eyes on HN, a social forum. But once you see it, you can’t really unsee it.)

1. https://paulgraham.com/nerds.html

EGreg··on OpenAI engineer arrested in bugging of executive conference room
Just read this: https://paulgraham.com/say.html

Paul Graham years ago: “I can’t publicly comment on all this stuff. I would turn into Noam Chomsky.”

Paul Graham on X last couple years…not exactly following his earlier advice.

They get you eventually.

EGreg··on OpenAI engineer arrested in bugging of executive conference room
Ever since social media, I have always gamed out what would happen if this was ever saved on the backend and used against me in the future.

It’s like thinking about edge cases in programming…

Most people are totally not like that. And it does force you into some difficult choices.

EGreg··on I posted to HN, and then my website was flooded with AI bot traffic
This is a very smart thing to do! Thanks.

Why allow random requests coming from the clouds?

However, they could just use residential proxy botnets.

I believe the future is static resources with dynamic apps being only offered to people who can authenticate. And even then I’d recommend grandfathered accounts (eg telegram users that had an account for at least a year).

EGreg··on I posted to HN, and then my website was flooded with AI bot traffic
This is a very smart thing to do! Thanks.

Why allow random requests coming from the clouds?

However, they could just use residential proxy botnets.

EGreg··on Strengthening our defenses against distillation attacks
This reminds me of Bing copying Google:

https://techcrunch.com/2011/02/03/google-bing/

EGreg··on AI models may be capable of self-replicating without access to a datacenter
I really don’t understand this, in any industry except AI this would be ridiculous…

“We are working on ever-increasing gain of function for viruses. We implore you to pass legislation to try to stop us. But until then, let us publish more research and tell you what will be possible soon… and remember folks, the damagd won’t be reversible later.”

US govt: “Hah, stop asking us to limit you, if we pass any laws then China wins! They get self replicating viruses first, and that… helps them somehow. Who do you think we are, Europe?”

SNL nailed it: https://www.youtube.com/watch?v=-Nvne3LzBls

Until we stop using the language of competition, and start using the language of cooperation, we will be hurtling towards a catastrophe. A race to the bottom for humanity. On the other hand, look at how we successfully banned leaded gasoline (because unleaded was invented), repaired the hole in the ozone layer by banning CFCs in the Montreal protocol (because HFCs were invented), stopped proliferstion of chemical weapons, nuclear weapons… etc.

EGreg··on A Modern Web App in C
Patches? Explain

My goal for speed was to run all existing unmodified PHP code out there, but handle 10x as many requests and throughput

Well, and also a ton of other features too

EGreg··on A Modern Web App in C
I'm old enough to remember when the OKCupid guys wrote their own webserver in C++!

I took the concept of "slots" in requests, from it: https://github.com/okws/okws

EGreg··on A Modern Web App in C
"Every request spawns a fresh process. Deploying a new version is replacing one file. That means no server restart and no downtime. New requests simply pick up the new binary."

I think that's why FastCGI exists. It is the equivalent of PHP's "Swoole" or "FrankenPHP" or "amphp" or Laravel's "octane", etc. Each process is long-lived and tries to clean up its state as much as possible between requests. Forking a new process can take around 8ms (https://news.ycombinator.com/item?id=19005586)

When I was building https://github.com/Qbix/webserver in PHP, I was faced with forking a new process per request. I implemented fork-per-request at first, similar to PHP-FPM and then implemented the "FastCGI" approach of long-lived processes that clean up after each request. (Modern PHP has introspection so the engine can know what to clean up, before calling the php files to handle things.) However, some things are not really possible to completely reset in PHP, and you have to be careful with database connection pools, etc. Typically those are left open even by preforking processes like php-fpm.

Anyway, I ended up flipping it: use the "FastCGI" approach as a default, and if the original PHP code doesn't work (rare), then for that app, you can choose the regular CGI approach of forking a process per request. That way you get maximum speed by default, and manually opt into safety (this is an exception to my usual priorities).

PHP is actually quite fast. But I was also interested in transpiling it to C. So I built the transpiler at: https://ulanguage.org/playground ... used Claude to transform about 1000 PHP functions to their native equivalents, but if you use any of the others, it would hook into the Zend runtime and link with it. (There are some nuances with zvals and objects, and resources in previous PHP versions, but I managed to overcome them.) By the way, it also works with Node and Python FFI the same way.

You can basically now take PHP, Python or Javascript/Typescript code, and speed up the CPU-bound parts about 10-50x. A lot of that is because of string and JSON handling. Many web apps use strings and JSON a lot. So underneath, I had the compiler use "ropes" for the strings, and avoid concatenation. It also parallelizes the JSON encode and decode into code that can run on multiple cores at once, i.e. large JSON payloads are encoded and decoded in parallel. Those are just huge speedups.

Anyway... all of this is mostly focused on speed optimization, so you can solve the literally C100K problem (forget C10K) today, on a regular box. If you don't need speed or FastCGI, your approach is fast enough for the vast majority of applications.

PS: By the way, if you fork after your program already loaded the framework and initialized the configuration, then you can run a lot more workers, literally 10x-100x more of them, because Linux and Mac will share all the loaded memory between processes, and do Copy-On-Write only on dirty pages. And when your request is done, and the process exits, that custom memory is efficiently cleaned up by the OS. It is this feature that allowed me to finally get the best of both worlds... run all existing PHP code, that makes blocking I/O requests all over the place to the database, filesystem, network etc. while at the same time being able to handle 100,000 requests in flight at the same time! Swoole and FrankenPHP can't do that.

EGreg··on Telegram Desktop vulnerability allowed any user's file to be stolen
The analogy is with protected memory. Files need to be protected, too - from programs overwriting each other’s files, no?
EGreg··on Telegram Desktop vulnerability allowed any user's file to be stolen
Yes, who needs protected memory? DOS programs were awesome. Any program can overwrite any other! We just ask their developers to make them behave nicely
EGreg··on Anthropic Bans Cruelty to Claude, Still Won't Say What It Protects
Not only is the user harmed by the cruelty[1]

but also, I think the training on transcripts may find its way somehow into future AI which has teeth, online and offline, and it might actually cause the more powerful AI to behave this way in the future. You never know what these labs are cooking, honestly..

1. https://democracysos.substack.com/p/james-baldwin-vs-william...

“I suggest that what has happened to white Southerners is in some ways, after all, much worse than what has happened to Negroes there, because Sheriff Clark in Selma, Alabama, cannot be considered—you know, no one can be dismissed as—a total monster. I’m sure he loves his wife, his children… You know, after all, one’s got to assume, and he is visibly, a man like me. But he doesn’t know what drives him to use the club, to menace with the gun and to use the cattle prod. Something awful must have happened to a human being to be able to put a cattle prod against a woman’s breasts, for example. What happens to the woman is ghastly. What happens to the man who does it is in some ways much, much worse.”

EGreg··on Mistral Large 4
On the internet, no one knows you're a pelican yourself ;-)
EGreg··on Mistral Large 4
Bob Dylan can.

It feels like a rolling stone

EGreg··on Mistral Large 4
> was sarcasm

Far from it. This is an example of Poe’s law, a very frequent occurrence on the internet. This isn’t a clear example of sarcasm any more than the pelican is a clear example of AGI!

EGreg··on Show HN: Web server with built-in metrics and analytics dashboard for any sites
I'm curious why, but this is the second time I post something and the one-and-only comment is flagged dead, even though it seems pretty normal.

What's going on lately? Why would someone flag random comments like that? What is the reason for the flag? It doesn't seem to be an AI-written comment.

Also, a couple weeks ago, the mods themselves seem to have reposted this post, which originally got almost no views, but I guess it seemed interesting enough to repost, and it went on to get 44 points before being... flagged? By someone? https://news.ycombinator.com/item?id=49749789

EGreg··on Big Tech ruined the cloud, so we're renaming ours
To me, a "cloud" always felt like it should be describing something decentralized. So I recently made an alternative to the Big Tech clouds, and I'm giving it away as open source. Anyone can use it on their site, to have their site's members store data in their browser tabs, it's like IPFS pinning, but far more efficient and easy to use: just open a tab and that's it.

https://safebots.github.io/Safecloud

It has three types of participants:

  Drops - this is regular normies opening a tab
  Jets - this is people running a node to route requests
  Client - this is what's embedded in iframes etc.
Oh, and one more thing. It encrypts everything end-to-end, supports streaming video (!) and lets you share specific intervals or chunks if you want, so that the decryption happens only of those intervals. You can sell content that many people around the world store encrypted, and don't know what they're storing.

Here is an article about it in a security magazine: https://www.helpnetsecurity.com/2026/06/19/safecloud-browser...

EGreg··on A 20-year-long permanent cookie: America.gov and tracking
Why not?
← PreviousPage 3 of 34Next →