Hacker News Reader

_lvbhon Discord group guessed the URL to Anthropic's Mythos model before CISA used it

This reminds me of when GPT-4 first released, the image capabilities were in preview and limited. A couple companies, including Perplexity, was leaking their API key on Replit & had early access by a couple weeks.

The dumb me at the time used it to do biology homework to do with diagrams instead of anything interesting...

I think the API endpoint was codenamed "rainbow" if I remember correctly. How time flies

_lvbhon How Monero’s proof of work works

Revolut -> USDC -> Monero via exchange

_lvbhon Fake Notepad++ for Mac

Not to mention it is almost entirely vibe-coded.

https://github.com/notepad-plus-plus-mac/notepad-plus-plus-m...

This type of behavior ought to get them blacklisted from the internet.

_lvbhon If society had a scorecard, what would be on it?

1. The standard of living for the bottom 5% of society in terms of basic needs (food, water, shelter, and health) 2. Equality. The distance between the bottom and top in terms of economic and political power. Not just votes, but absolute power including if lobbying is allowed. 3. Hours of work per capita required to maintain current standard of living

_lvbhon If I could make my own GitHub

Oh wow. Tangled's support for jujutsu is exactly what I've been looking for! There's my weekend gone to getting that self-hosted.

_lvbhon Ask HN: Any Developer from Wales?

Love the place. Rent is good compared to the rest of the UK. People are friendly & welcoming. University isn't the best though.

_lvbhon Human Source License (HSL)

https://www.linkedin.com/in/ralph-m-debusmann-63204675/

Author works for that company. License is copied from https://github.com/xdgrulez/kafi which I presume was made for said company and therefore must contain the exception.

_lvbhon Ask HN: Any Developer from Wales?

Rare Wales mention! I'm currently in Cardiff (capital of Wales)

Most jobs here are C#, Java, and Python. Job market is decent. Lots of people have been moving here lately as developers. Expect very low pay relative to London or US though.

I also know some people living in Cardiff but working remote for companies in Reading or Warwick. Also a few people working fully remote for Bluesky.

I'm personally moving out (to San Francisco) to pursue a startup though

_lvbhon Show HN: OpenDescent, decentralised encrypted messenger, no servers, no accounts

AI generated slop with fake comments from new accounts

_lvbhon Show HN: Screenshot web components with one click

I think on Firefox, if you right click and press screenshot, it lets you choose a component. Use that quite often

_lvbhon Ask HN: What are you moving on to now that Claude Code is so rate limited?

I get GitHub Copilot Pro for free for some reason. One day I checked and it was just there. So I use that until it runs out. When it does, https://synthetic.new with Kimi K2.5 works surprisingly well for small tasks where I still make all the decisions.

But I find no matter what I use, it still makes more sense to code by hand for anything that actually matters.

The things I've vibe coded are throwaway scripts to generate a gif, user scripts to tweak annoying websites, and various utilities that just need to work.

_lvbhon Show HN: Mtproto.zig – High-performance Telegram proxy with DPI evasion

Very obvious with the GEMINI.md.

I wish there was a rule to ban AI submissions. Not because I think there's 0 value, but because there's just such a high volume and low signal to noise ratio

_lvbhon Decisions that eroded trust in Azure – by a former Azure Core engineer

Could you link the story by any chance? I've been using Longhorn for a while and on one particular system, it has an odd tendency to corrupt XFS.

_lvbhon Axios compromised on NPM – Malicious versions drop remote access trojan

There are definitely levels to this. Yes I think it can be caught by automated scanners in theory. Either commit by commit scanning and reproducible builds or fuzzing and getting the behavioral differences between versions

_lvbhon Axios compromised on NPM – Malicious versions drop remote access trojan

Hence why you source data from multiple vendors I'd say. Rather than putting all eggs in one basket

_lvbhon Axios compromised on NPM – Malicious versions drop remote access trojan

There are so many scanners these days these things get caught pretty quick. I think we need either npm or someone else to have a registry that only lets through packages that pass these scanners. Can even do the virustotal thing of aggregating reports by multiple scanners. NPM publishes attestation for trusted build environments. Google has oss-rebuild.

All it takes is an `npm config set` to switch registries anyways. The hard part is having a central party that is able to convince all the various security companies to collaborate rather than having dozens of different registries each from each company.

Rather than just a hard-coded delay, I think having policies on what checks must pass first makes sense with overrides for when CVEs show up.

(WIP)

_lvbhon I'm betting on ATProto

Did it? Just checked and my feed is still completely untranslated. I have my settings set as English. I hope they don't do the weird YouTube thing of translating things from languages you know into the language you set. Multilingual people exist

_lvbhon I'm betting on ATProto

Utaite. Will find barely any anywhere else. Thankfully if you're in one of those sub-communities, you don't ever get recommended anything political or American.

_lvbhon My MacBook keyboard is broken and it's insanely expensive to fix

I've personally found the repairability to be worth the price for me. I got the baseline $999 back when it launched & have done stupid things like spilling a whole gallon of milk on it. Had to take it apart & clean as well as replace the keyboard but now it's still chugging along. Used to own a MacBook & the keyboard started dying after a year with a failed A key. Very expensive to replace so I just remapped caps lock to A. Then the screen started getting weird color issues and dead pixels. A MacBook Neo does look attractive though. Probably better performance.

_lvbhon 90% of Claude-linked output going to GitHub repos w <2 stars

Stars occasionally correlate with quality but more often it's timing and naming. I have a total of 40k stars on GitHub, and I know the code is shit in most of those repos (many written back when I was 16-18 as I was just learning to code). Jumping on hype trains before they start is how you get stars.

_lvbhon UK total wind generation record beaten today

Not surprised either. I'm down in Wales & I could hear the glass pane shaking

_lvbhon purl: a curl-esque CLI for making HTTP requests that require payment

A couple questions:

- The default seems to make the payment without confirmation. What stops an endpoint from changing payment amount between an inspect request and the actual request?

- Will adoption of this payment protocol ever grow large enough for anyone to implement this on either the client or server?

- Bots have more of a financial incentive to crawl sites than a human. I doubt this will actually stop anything

- I see a AGENTS.md. How much of this is vibe coded? It's near impossible to get a sense of the care taken to review LLM output. Hard to trust with money.

_lvbhon Show HN: OxiMedia – Pure Rust Reconstruction of FFmpeg and OpenCV

What does production ready even mean? The problem with AI is that there isn't an obvious way to prove how much human attention\care was actually put in & thus no signal on quality. Nobody is gonna review 1M lines. Also, the 1M line number shouldn't really be a boast. More lines != higher quality or more features

_lvbhon Package managers need to cool down

I've been working on a project lately as my bachelor's dissertation which I later plan on working on long term on this issue.

The basic premise is a secure package registry as an alternative to NPM/PyPi/etc where we use a bunch of different methods to try to minimize risk. So e.g. reproducible builds, tracing execution and finding behavioral differences between release and source, historical behavioral anomalies, behavioral differences with baseline safe package, etc. And then rather than having to install any client side software, just do a `npm config set registry https://reg.example.com/api/packages/secure/npm/`

eBPF traces of high level behavior like network requests & file accesses should catch the most basic mass supply chain attacks like Shai Hulud. The more difficult one is xz-utils style attacks where it's a subtle backdoor. That requires tests that we can run reproducibly across versions & tracing exact behavior.

Hopefully by automating as much as possible, we can make this generally accessible rather than expensive enterprise-only like most security products (really annoys me). Still definitely need a layer of human reviews for anything it flags though since a false positive might as well be defamation.

Won't know if this is the right direction until things are done & we can benchmark against actual case studies, but at least one startup accelerator is interested in funding.

_lvbhon Wikipedia was in read-only mode following mass admin account compromise

Not quite sure which channels I should reach out via but I've put my email on the page so they can contact me.

Based on timings, it seems that Wikipedia wasn't really at risk from the domain being bought as everything was resolved before NS records could propagate. I got 1 hit from the URL which would've loaded up the script and nothing since.

_lvbhon Wikipedia was in read-only mode following mass admin account compromise

I registered it about 40 minutes ago, but it seems the DNS has been cached by everyone as a result of the wikipedia hack & not even the NS is propagating. Can't get an SSL certificate .

_lvbhon Motorola announces a partnership with GrapheneOS

> they are using Apple's Wi-Fi positioning service, but proxying it through their own servers

My concern with this system is that their proxy is (afaik) compatible with Google's format, which by default is less privacy respecting as it does the location calculation server side and doesn't allow the client to cache.

I'd much prefer if they called out to Apple's servers directly (or through a direct proxy) & cached the AP data locally so over time it will work offline.

_lvbhon We're no longer attracting top talent: the brain drain killing American science

100% agree even as someone who grew up around people speaking mandarin. I still cannot write despite having taken the language in both GCSEs and IB, while also living in the country for 3+ years.

i can speak the language just enough to get by but once you get into technical terms, i'm once again completely lost. Unless they do a Singapore or Dubai and make business in English, i dont see any chance of them attracting talent

_lvbhon Psychosis.hn

First try I got 0/5 with 3 false positives, by the third i got 4/5 with 1 false positive.

it's getting scary, i don't know how much longer we can tell humans apart from AI

_lvbhon As HN: Why is no one using my free library?

stop thinking of open source as padding for resume. you'll mostly be disappointed unless you're very lucky.