NorwegianDude

Grok is the least "honest" out there. And you should 100 % never believe anything Elon Musk says, he's one of the most clueless and unreliable people in existence.

Grok had specific baked in instructions to avoid negative statements about Musk and Trump, how is that for truth seeking? No other LLM company has done that from what I know.

HN load isn't exactly a high load for a server. The automated traffic was most likely much higher, but not high, as the server used the super slow single threaded php dev http server, so high traffic was not possible, everyone had to wait their turn.

The steal my Bitcoin challenge was nothing like a realistic common PHP setup. It was a extremely unrealistic and stupid setup, using the built in php dev server. It's even explicitly stated that it should never be exposed to the internet.

If it needs to hit the same worker to get it to work, that is a whole other problem, and that was not a part of the steal my bitcoin challenge. And what if pm.max_requests is set to 1? Is it then 100 % safe, as it respawns for each requests, making any statement for an universal exploit completely BS, or is a single requests exploit possible?

This was presented as a normal setup of PHP, but in reality was something completely different. Nobody runs PHP like this. This used the dev server in PHP and proxied requests from nginx to the php http dev server. Literally the first thing in the php docs about the dev server is:

"Warning This web server is designed to aid application development. It may also be useful for testing purposes or for application demonstrations that are run in controlled environments. It is not intended to be a full-featured web server. It should not be used on a public network."

It's also singel threaded and very slow, so that explains why the site was so damn unusable.

It's a shame, as a realistic setup would be much more informative.

To be fair, the person who created the challenge stated that is was a fairly standard setup, replicating something outside a lab, but in reality is was something completely different, and not anywhere near how PHP is usually used.

It used the development server in PHP, and did not even run requests with fpm or mod_php. Instead, it used the built in dev server of PHP, and just proxied requests from nginx to the php dev server.

Literally the first thing on top of the PHP docs about the dev server used here is this: "Warning This web server is designed to aid application development. It may also be useful for testing purposes or for application demonstrations that are run in controlled environments. It is not intended to be a full-featured web server. It should not be used on a public network."

That is not something people do, and it also explains why the site was down all the time, cause the dev server is super slow, as it's not meant for this in any way shape or form. A real setup would add a few zeros to the requests per second a server could handle.

So all in all, this was very pointless, as it was nothing like real php sites. A shame, cause a realistic setup woild be more interesting and relevant to answer the question of how hard is it really to gain RCE on a normal site.

What is the normal config? Could you publish the setup on GitHub or anything like that? I see some say that it is hardened, others saying it doesn't run PHP etc.

Would be fun to see what it's actually running. :)

They are not selling tokens at a loss, they have insane profit on tokens. It's the only think making them money instead of loosing money.

But at least he has $66B in BTC. /s

While I kinda agree, please do some testing and validation of frontend for websites too, cause LLMs are quite bad at it. It might look right, but usability and performance is often terrible. But that is often the case for pages made by humans to, so... Garbage in, garbage out, I guess.

To be fair, if LLMs were good at decisions, we would not need people.

It's a "sports car". At least that is what all the marketing says and has said since forever. Even the title on the website is "Electric sports car". But it's not really a sports car, it's a fantasy car that does not exist, and never will exist.

And the car would have 4 seats(now 2), over 1000 km range(now less than half), and be the fastest car period(now very far off). Then they say it will do 300 and something km/h, but also say it will do Mach 0.5. They are completely clueless, as usual.

Bigger and still worse than existing free Chinese models that are smaller? Open weight models are nice, but at this point it seems western models are very far behind Chinese ones, despite Chinese companies publishing a lot of their findings. I hope we get more open models and more providers, as being stuck with a model from China or US with no competition is risky.

Google does do a great job with Gemma models. It's one of the few language models actually good at language. OpenAI's top closed models can't even write norwegian correctly.

As you say, the driver skill is very different between F1 and GT3. If traction control was allowed in F1, the teams would not settle for something like in GT3, it would become an arms race. In the end we might end up with racing determined by who has the best control algorightms, and not who has the best dirver/chassis.

Codex/ChatGPT Pro 20x isn't really a thing now, they have disabled it a week or two ago.

OpenAI didn't mess up. The model would have been 100 % pointless and obsolete without the large price cuts it got, because of the cheap Chinese models.

The open models are getting closer and closer, and because they're open, people are not forced to pay the silly markup that is often over 1000x the cost to serve the model.

There is no fixed tariff in Europe like you are quoting. It varies.

The US even said it was Iran who did it. The US has literally become the least trustworthy nation in the world by lying about everything, threatening to go to war against allies for no other reason than wanting the land...

This must be satire? Makes no sense. OpenAI isn't worth anywhere close to $800B. The gap to open models is shrinking fast, and it seems that many companies will have models with around the same capabilities.

And have you guys seen the compression ratio of models capabilities? The new Qwen3.8 27B is insane. I can run it at 85-95 tokens per second on my personal PC, and it is, according to artificial analysis benchmarks, around the same level as GPT 5.4 xhigh from march, OpenAIs leading model at that time.

If things keep going this way, OpenAI and it's infrastructure is worth...very little.

If the benchmarks are a real indication, we now have a local model that is runnable on a high-end personal PC that trades blows with the leading model Claude Opus 4.6 Max from half a year ago.

Insane if that is the case. Downloading now!

llama.cpp has router mode these days, swapping out models for you, you no longer need llama-swap.

But also remember that while the API cost might be >50x the subscription cost, the actual cost to run it is much much cheaper.

It will only become cheaper as models become more efficient.

That is the most recent Qwen and Google models, there is no newer version, yet. Qwen3.8 27B might come in a couple of days tho, if it's launched alongside the large one when the Qwen3.8 countdown reaches zero.

Well, I can run some models that are better than some of the weaker and cheaper Anthropic models locally, like Haiku 4.5, and solve tasks that would cost ~4500$ every day in tokens, so yeah, they are definitely extremely profitable on inference.

Eh, what are you guys even talking about? Deepseek is not cheapest provider as is, and it's MIT. So deepseek making it more expensive to use is just nonsense, they can only change their own pricing. It's the beauty of MIT license and open weights. If anything, these models are some of the safest in the world to use if you worry about a rug pull.

You can get easily over 100 tok/s on the Gemma 4 31B QAT if you enable MTP. Same goes for the 27B. I'm getting 880 tok/s of throughout on a single RTX 5090 for batch tasks.

While most don't, there are developers who actually do understand systems from end to end. Most developers are terrible developers, compared to the really good ones.

I've been running a small game dev studio for ~20 years, and the one change I think must be made, is to ban the usage of "buy" when it comes to games. Games are licensed, not bought, and that should be crystal clear to those who are paying.

Most of the games people play runs using proprietary software and/or licenses, and often on very specific hardware, with game features that makes sense for the amount of players the game has. Requiring that people should be able to play such games if the company stops running it would completely change and limit how games are developed, and in many cases require a completely different version of the game to be co-developed in case people stop playing it. It would with 100 % certainty result in slower development, fewer games, and worse games.

I do of course think that developers should try to make games playable without the company being involved, within reason. Some games that do not have licensing issues or complicated server backends as a requirement could be made available without too much work. But for things like e.g. MMORPGs it's nearly impossible. If your ever developed bigger software systems you know how many moving parts are involved, so just imagine the difficulty of making it work on consumer machines...

A common extreme misconception is that inference is expensive and that providers are loosing a lot of money. Inference is extremely lucrative and profitable.

But you are talking about Europe. If the US and Europe were to cut all ties they would both face some serious consequences, and the US wouldn't be able to do anything about that, not strategically or military. The US need trust in order to function, and attacking would loose them all trust globally, making it much much more severe than anything any other nations would struggle with.