HNHacker News
TopNewBestAskShowJobs

Onavo

1,005 karma · joined May 20, 2023

submissionscomments
Onavo··on Tell HN: I unknowingly broke the PHP RCE embargo. I am sorry
Not sure what you are apologizing for. It's a severely overblown bug that ended up on the front page of New York Times and the Japan Prime Minister had to get involved too. The bug itself is non trivial to exploit from just public requests to a web server so I am not sure what the hysteria is about. It's no different from the other hundred or so CVEs I see being posted or dropped everyday.

It will be headlines on Hacker News regardless due to sheer sensationalism, I think most DevSecOps people would rather find out the news here first than via their boss calling them after reading the morning news.

Onavo··on EA is shutting down BioWare
I see the acquisition by the Saudi government is going well.
Onavo··on SlopCodeBench 10/2026 – Opus 5.5, Astra wins overall, xhigh considered harmful
I think people downvoting you missed the sarcasm.
Onavo··on SlopCodeBench 10/2026 – Opus 5.5, Astra wins overall, xhigh considered harmful
I wish a company named human layer won't write their reports with so much Claudisms.
Onavo··on Android apps running native on macOS
That's the GPT style writing, there are subtle differences between it and Claude if you know where to look.
Onavo··on I built a drone with only one motor [video]
Well not just battlebots, real life 6th gen fighters now all lack the vertical stabilizer so they have to rely on very sensitive real-time software control of the elevator/spoilerons to do banks and yaws. Not sure if it counts as under-actuated but they are tremendously difficult to steer without computer control.
Onavo··on Wine ported to OpenBSD
What about the most difficult game of all, Microsoft Office?
Onavo··on British Airways: Filming Crew W Meta Glasses Could Get Your Tickets Cancelled
Oh they are trying their very best to go the way of policing. For example just last week Delta's PR team has been working overtime to make sure one of their South American customer abuse cases don't get picked up by the English speaking media. You won't see this anywhere in major US media because the victim was a foreigner (Santiago Daza) from a poor country like Colombia. Delta's team did a wonderful job of suppressing it. If they tried this with a rich French or Chinese they would have been raked over the coals and on their knees apologizing. The foreign media and internet users would not let them go so easily.

See for yourself. https://viewfromthewing.com/delta-passenger-got-kicked-off-a...

https://www.reddit.com/r/delta/comments/1x0ej7v/passenger_re...

Onavo··on British Airways: Filming Crew W Meta Glasses Could Get Your Tickets Cancelled
> They literally aren't, though.

That's a distinction without a difference. There are enough structural constraints in launching airline alternatives that they might as well be, especially the national carriers. They are not too far from being a utility (and in a lot of places they are subject to enormous amount of public funding to stay solvent because it's a national security issue when you don't have a pool of pilots and airplanes).

It's one of those "too big and too important to fail" businesses. There can be the occasional M&A or bankruptcy but no structural industry collapse is allowed. It's as important as the car industry in some places, though the reasons differ.

Do you expect the masses to fly private jets or Cessnas to cross the globe? It's like saying electrical companies shouldn't be regulated too much in certain jurisdictions because the generators are privately owned rather than being publicly owned. People will laugh you out of the court of public opinion.

Onavo··on Matthew Prince on why Cloudflare offers a free version and always will (2016)
Most people have forgotten just how cheap bandwidth is. Too much AWS lead cloud pricing propaganda brain rot. Without the high prices, your big clouds won't be able to afford 6-7 figs of engineering salary.

If you have questions about bandwidth pricing, just go lookup the video piracy streaming sites that's almost completely powered by ads. They are not YouTube scale and most barely last a year before they have to come back with a new domain (because of deplatforming, not because they ran out of money).

A terabyte of bandwidth is maybe worth a dollar at scale (amortized globally, some places are more expensive than others i.e. Africa, certain parts of Asia). Yet the managed clouds gouge customers like there's no tomorrow.

Onavo··on DeepSeek-v4.1-Flash-1017
Performance charts and benchmarks are here:

https://www.reddit.com/r/DeepSeek/comments/1x84wke/deepseek_...

Onavo··on Show HN: Stoke Money – Personal finance app built around a cash flow forecast
I would tell you to ignore that and do the exact opposite. You are targeting B2C. Avoid the hacker news crowd they are not worth the trouble for this sort of thing. It's a distraction and if you believe the product advice here companies like Dropbox won't exist because FTP is a thing.

You need to spam growth and marketing. Your landing page is horrible (too boilerplate, too vibe coded, no graphics. Some pages have horizontal overflows on mobile. https://stoke.money/compare/simplifi). Redo it. Run ads and pay Tiktok influencers and YouTubers.

Standard consumer SaaS security is more than enough for this sort of product. Your users won't know the difference between end-to-end encryption and encryption at rest and while you are nitpicking based on hacker news power user feedback others would eat your lunch already.

If you are a US fintech, monetizing consumer user data is par for the course. Do what you will with that information but just know that your competitors don't simply make money from subscriptions alone.

Onavo··on Meta’s new commercial terms will allow the scraping of news sites: experts
If they really want to be spiteful they can rewrite all the news articles they post to Meta using Muse. Then we can finally see if the theories of statistical model collapse hold up at the trillion param level model scale.
Onavo··on Passkeys are not a trap
Well designed platforms and auth frameworks allow adding multiple passkeys. The problem is this requirement was never coded into the passkey standard.
Onavo··on AWS Lambda Web Functions
This looks suspiciously like Vercel's fluid compute..
Onavo··on Show HN: Use your OpenAI subscription to create audiobooks
They do offer an OAuth method.
Onavo··on Codex CLI installs a persistent, self-updating background daemon by default
Even if you installed codex with brew?
Onavo··on Postgres isn't slow, your storage is
The issue is that on prem suffers from too many edge failure cases. It's cheaper to pay S3 to deal with the problem than to have a full team dealing with bit rot from RAID issues. It's one thing to have an home office/home lab server, it's another thing entirely when you have terabytes of content that can't tolerate any data loss and you don't have engineers on call at 3am.

I am no fan of the idea of reinventing everything to run on cloud primitives but you can't deny reliability of online software is a lot higher now than the pre HTML5 era. Back then, having more than two nines of uptime for random backend heavy web apps was hardly common while now it's table stakes.

Onavo··on Attack of the Vibe Coded Photoshop Clones
I am actually quite curious if the original Thaumcraft mod author Azanor is on HN. I know a lot of the original generation of Minecraft modders (pre twitch, mostly YouTube days, Minecraft modding changed a lot post twitch) are fairly senior software engineers (most famous one is probably Sethbling, though he didn't really do modding).

There's a "Direwolf20" on hacker news too but that user has nothing to do with the famous Minecraft modder afaik.

Onavo··on Attack of the Vibe Coded Photoshop Clones
Just recently there was a massive kerfuffle in the Minecraft modding community because a mod called Thaumcraft was recreated after it was effectively abandoned for 7 years. The mod's management team threatened copyright legal action.

It's extremely ironic seeing the modding community, which generally play fast and loose with IP rights, all of a sudden care about them when AI made modding trivial.

You can see some of the community responses here, it's hilarious.

https://www.reddit.com/r/feedthememes/comments/1x2gu7j/so_wh...

https://www.reddit.com/r/feedthememes/comments/1x3b5pk/looki...

https://www.reddit.com/r/feedthememes/comments/1x0p9ap/when_...

https://www.reddit.com/r/feedthememes/comments/1x1q6bx/from_...

https://www.reddit.com/r/feedthememes/comments/1x1mqb2/the_c...

https://www.reddit.com/r/feedthememes/comments/1x3v6qw/what_...

https://www.reddit.com/r/feedthememes/comments/1x3kw5r/glad_...

https://www.reddit.com/r/feedthememes/comments/1x2mx4w/reaso...

I have not seen such delicious drama in the Minecraft modding world in years ever since the Forge/Neoforge schism.

Onavo··on Rampart: Browser native on-device PII radaction
Same technique is good enough.
Onavo··on Rampart: Browser native on-device PII radaction
A lot of clinical decision support AI tools essentially scrub the PHI data on the frontend.
Onavo··on Rampart: Browser native on-device PII radaction
It's the technique used by a lot of AI healthtech
Onavo··on Can you use autoregressive diffusion to generate market data?
Plans don't determine outcome though, only broad sector movements eg announcing you are doing AI tend to produce a small spike in price, effect is slowly diminishing though.
Onavo··on Rampart: Browser native on-device PII radaction
Is this good enough for HIPAA?
Onavo··on A statement on the Tor Project's relationship with Mullvad
But the question is, if the speaker of vile speech is being persecuted by the powers that be, will said brave "free speech absolutist" NGOs step up or will they be conspicuously absent?
Onavo··on A statement on the Tor Project's relationship with Mullvad
Well, their defence now is probably contingent on a donation first.
Onavo··on A statement on the Tor Project's relationship with Mullvad
How secure is SimpleX? I saw a lot of tinfoil hat people on Reddit claiming that it's the next coming of Signal.
Onavo··on A statement on the Tor Project's relationship with Mullvad
> While Tor defends free speech, not all speech is equally compatible with our mission.

It's sad to see the backslide. In the olden days free speech absolutists would defend all speech short of fires in the cinema. Nowadays it has to be compatible with their brand of political correctness else they will tar and brush you or stay conspicuously silent.

You see the same backsliding in the Electronic Frontier Foundation and other non profits. They are a lot more neoliberal now than liberal. Interests over values.

Onavo··on Typesafe AI raises $870M at $7.5B
You are used to dealing with companies where the money bags hold the power.

When you are in the middle of a boom cycle, it's the hottest company that has the advantage. Investing in them is a matter of privilege and they get to pick and choose.

Also, Canadian VCs are bottom of the barrel as far as VCs go.

← PreviousPage 3 of 34Next →