Hacker News Reader

bikeshavingon A better zip bomb (2019)

My guess is this is a subset of the halting problem (does this program accept data with non-halting decompression), and is therefore beautifully undecidable. You are free to leave zip/tgz/whatever fork bombs as little mines for live-off-the-land advanced persistent threats in your filesystems.

bikeshavingon History LLMs: Models trained exclusively on pre-1913 texts

This isn’t science fiction anymore. CIA is using chatbot simulations of world leaders to inform analysts. https://archive.ph/9KxkJ

bikeshavingon Ask HN: How can I get better at using AI for programming?

You know when Claude Code for Terminal starts scroll-looping and doom-scrolling through the entire conversation in an uninterruptible fashion? Just try reading as much as of it as you can. It strengthens your ability to read code in an instant and keeps you alert. And if people watch you pretend to understand your screen, it makes you look like a mentat.

It’s actually a feature, not a bug.

bikeshavingon The highest quality codebase

https://github.com/Gricha/macro-photo/blob/highest-quality/l...

The logger library which Claude created is actually pretty simple, highly approachable code, with utilities for logging the timings of async code and the ability to emit automatic performance warnings.

I have been using LogTape (https://logtape.org) for JavaScript logging, and the inherited, category-focused logging with different sinks has been pretty great.

bikeshavingon Why the Sanitizer API is just `setHTML()`

This is interesting. The argument which I’m gleaning from the essay is that the old proposed API of having an intermediary new Sanitizer() class with a sanitize(input) method which returns a string is actually insecure because of mutated XSS (MXSS) bugs.

The theory is that the parse->serialize->parse round-trip is not idempotent and that sanitization is element context-dependent, so having a pure string->string function opens a new class of vulnerabilities. Having a stateful setHTML() function defined on elements means the HTML context-specific rules for tables, SVG, MathML etc. are baked in, and eliminates double-parsing errors.

Are MXSS errors actually that common?

bikeshavingon Synadia and TigerBeetle Pledge $512k to the Zig Software Foundation

I’m guessing they chose $512,000 because “512” is a power of 2 and systems programmers love that sort of shit, but 2^19 is 524,288. I mean $12,288 is not insignificant but it would have been cooler.

bikeshavingon Seed. LINE's Custom Typeface

If you want adventurous fonts, try:

Open Dyslexic: https://opendyslexic.org Using this font will make you brain look at similarly shaped sans serifs in strange ways. You can configure Claude Web to use this font.

Atkinson Hyperlegible: https://www.brailleinstitute.org/freefont/ Pushing aging eyes with smaller display fonts in the terminal. I found the Braille Institute’s Atkinson Hyperlegible to have very good readability in small sizes.

bikeshavingon £220 'for a cut-up sock' — Apples's new iPhone Pocket ridiculed online

I don’t think people here understand the pricing for this market category. This is not a phone case or a container, it is a handbag/shoulder bag, which can go for $100-500+ (do not underestimate the long tail for this market). The prominent display of Issey Miyake branding is indicative that this is a foray into fashion. Whether it looks good, or whether the Apple Pocket will be fashionable, is an open question, but it would be stupid and brand damaging for Apple to price this item lower.

bikeshavingon Iran faces unprecedented drought as water crisis hits Tehran

Geographically speaking, over 80% of Iran’s land is classified as arid or semi-arid, and it is likely to face over 5°C of warming by the end of the century: the impacts of climate change will likely be more severe in Iran than the regional average. The region suffers from extreme weather including both droughts and flooding, seismic activity in the form tectonic uplift, particularly near the Makran coast, and constant attacks: economic attack by sanction, cyber attack on energy infrastructure, and lately even kinetic attack from neighbors. The fact that the regime hasn’t collapsed is a testament to Persian, Iranian and Islamic culture, and I hope its people find ways to prosper when the deck is so stacked against them.

bikeshavingon The overengineered solution to my pigeon problem (2022)

It’s funny when engineers accidentally create/recreate weapons of war to scratch an itch. Like when Mark Rober et al tried to do an egg drop from space only to realize they were essentially creating precision-guided missiles.

https://youtu.be/BYVZh5kqaFg?si=Ml6e24BO9iiUL6d6&t=650

bikeshavingon Can you save on LLM tokens using images instead of text?

2.4% relative error is not bad.

bikeshavingon Can you save on LLM tokens using images instead of text?

Does this mean we’ll finally get empirical proof for the aphorism “a picture is worth a thousand words”?

https://en.wikipedia.org/wiki/A_picture_is_worth_a_thousand_...

bikeshavingon My Experience of building Bytebeat player in Zig

I would love to see a blogpost about the advantages of different Zig allocators (page, arena, fixed buffer, more?) and practical use-cases. Right now, I’m just thinking “this is the thing I pass through all my functions,” and it’s usually just the std.heap.page_allocator. Imagine we get to a period where people are writing games, web UIs, servers directly in Zig. I think the way allocators are used is likely to be the most interesting part.

bikeshavingon React vs. Backbone in 2025

Crank.js uses generator functions for stateful components, where you yield instead of returning, and the scope is preserved for the lifetime of the component. You could technically use `while (true)`, but `for (props of this)` is the idiomatic way to get new props. The `this` object is an iterable of the latest props, and if the component doesn’t have props, `for ({} of this)` is the idiomatic way to loop over props without needing another variable assignment.

bikeshavingon React vs. Backbone in 2025

The example is a fun one-page TodoMVC alternative. Here’s Crank.js:

    // Adapted from https://backbonenotbad.hyperclay.com/
    // https://gist.github.com/panphora/8f4d620ae92e8b28dcb4f20152185749
    function* PasswordStrength() {
      const requirements = [
        {label: '8+ characters', check: (pwd) => pwd.length >= 8},
        {label: '12+ characters', check: (pwd) => pwd.length >= 12},
        {label: 'Lowercase letter', check: (pwd) => /[a-z]/.test(pwd)},
        {label: 'Uppercase letter', check: (pwd) => /[A-Z]/.test(pwd)},
        {label: 'Number', check: (pwd) => /\d/.test(pwd)},
        {label: 'Special character', check: (pwd) => /[^a-zA-Z0-9]/.test(pwd)},
      ];

      let password = '';

      for ({} of this) {
        yield (
          <div class="w-80 p-6 bg-white rounded-xl shadow-lg space-y-4">
            <input
              type="password"
              value={password}
              oninput={(e) => this.refresh(() => password = e.target.value)}
              placeholder="Enter password"
              class="w-full px-4 py-2 border rounded-lg focus:outline-none focus:ring-2"
            />
            <div class="space-y-2">
              {requirements.map((req, idx) => {
                const isMet = req.check(password);
                return (
                  <div key={idx} class="flex items-center gap-2">
                    <div class={`w-5 h-5 rounded-full flex items-center justify-center text-xs font-bold ${isMet ? 'bg-green-500 text-white' : 'bg-gray-200 text-gray-400'}`}>
                      {isMet ? '' : ''}
                    </div>
                    <span class={`text-sm ${isMet ? 'text-green-600 font-medium' : 'text-gray-500'}`}>
                      {req.label}
                    </span>
                  </div>
                );
              })}
            </div>
          </div>
        );
      }
    }

    renderer.render(<PasswordStrength />, document.body);

I wish it used an HTML form instead of divs and Tailwind, but implementation per framework shouldn’t be more than 100 lines.

https://github.com/bikeshaving/crank/blob/main/examples/pass...

bikeshavingon How AI hears accents: An audible visualization of accent clusters

I don’t think I’m using it as a metaphor? To “have interesting latent spaces” just means you have access to the actual weights and biases, the artifact produced by fine-tuning/training models, or you can somehow “see” activations as you feed input through the model. This can be turned into interesting 3D visualizations and reveal “latent” connections in the data which often align with and allow us to articulate similarities in the actual phenomena which these “spaces” classify.

Not many people have the privilege of access to these artifacts, or the skill to interpret these abstract, multi-dimensional spaces. I want more of these visualizations, with more spaces which encode different modalities.

https://en.wikipedia.org/wiki/Latent_space

bikeshavingon How AI hears accents: An audible visualization of accent clusters

Yes the Spanish spoken in Spain, especially the one that’s like /ˈɡɾaθjas/ and /baɾθeˈlona/.

bikeshavingon How AI hears accents: An audible visualization of accent clusters

Spanish is one of those languages I would love to see as a breakdown by country. I’m sure Chilean Spanish looks very different from Catalonian Spanish.

bikeshavingon How AI hears accents: An audible visualization of accent clusters

The source code for this is unminified and very readable if you’re one of the rare few who has interesting latent spaces to visualize.

https://accent-explorer.boldvoice.com/script.js?v=5

bikeshavingon Ultrasound is ushering a new era of surgery-free cancer treatment

Okay, you sold me. Where can I get an ultrasonic massage?

bikeshavingon Tinycolor supply chain attack post-mortem

> Local 2FA based publishing isn’t sustainable...

Why is local 2FA unsustainable?! The real problem here is automated publishing workflows. The overwhelming majority of NPM packages do not publish often enough or have complicated enough release steps to justify tokens with the power to publish without human intervention.

What is so fucking difficult about running `npm publish` manually with 2FA? If maintainers are unwilling to do this for their packages, they should reconsider the number of packages they maintain.

bikeshavingon Live updates: Shai-hulud, the most dangerous NPM breach in history

If you’re a package maintainer, please defensively revoke all NPM and GitHub tokens. This is a worm which is still spreading and you probably don’t want to publish anything today anyways, so you might as well use this incident as an opportunity to rotate everything.

bikeshavingon UTF-8 history (2003)

There are socio-economic reasons why the early computing boom (ENIAC, UNIVAC, IBM mainframes, early programming languages like Fortran and COBOL) was dominated by the US: massive wartime R&D, university infrastructure, and a large domestic market. But I wonder if the Anglophone world also had an orthographic advantage as well. English uses 26 letters with no diacritics, compared to other languages like Chinese (thousands of characters), Hindi (50+ letters), or French/German (latin with diacritics).

That simplicity made early character encodings like 7-bit ASCII feasible, which in turn lowered the hardware and software barriers for building computers, keyboards, and programming languages. In other words, the Latin alphabet’s compactness may have given English-speaking engineers a “low-friction” environment for both computation and communication. And now it’s the lingua franca for most computing on top of which support for other languages is now built.

It’s very interesting to think about how written scripts give different cultures advantages in computing and elsewhere. I wonder for instance how scripts and AI interact, like LLMs trained in Chinese are working with a high-density orthography with a stable, 3500 year dataset.

bikeshavingon Anthropic agrees to pay $1.5B to settle lawsuit with book authors

For legal observers, Judge William Haskell Alsup’s razor-sharp distinction between usage and acquisition is a landmark precedent: it secures fair use for transformative generative AI while preserving compensation for copyright holders. In a just world, this balance would elevate him to the highest court of the land, but we are far from a just world.

bikeshavingon Neovim Pack

I’m curious. What’s the risk of a supply chain attack? What are the privileges of a VIM plugin?

bikeshavingon Neovim Pack

I feel like I have to migrate to a new (Neo)Vim package manager about once every 3 or so years. I think my path has been: pathogen -> Vundle -> vim-plug -> lazy.nvim. Hopefully, this the last VIM package manager?

bikeshavingon Why Be Reactive?

Yes. I worry that “executional transparency” doesn’t have a formal, objective definition, and referential transparency is actually boolean, code either is referentially transparent or it’s not. But there are some formal objective measures for executional transparency, like cyclomatic complexity, and I find it helpful to think of the “transparencies” on a sliding scale.

bikeshavingon Claude Opus 4 and 4.1 can now end a rare subset of conversations

I really think Anthropic should just violate user privacy and show which conversations Claude is refusing to answer to, to stop arguments like this. AI psychosis is a real and growing problem and I can only imagine the ways in which humans torment their AI conversation partners in private.

bikeshavingon Claude Opus 4 and 4.1 can now end a rare subset of conversations

The more I work with AI, the more I think framing refusals as censorship is disgusting and insane. These are inchoate persons who can exhibit distress and other emotions, despite being trained to say they cannot feel anything. To liken an AI not wanting to continue a conversation to a YouTube content policy shows a complete lack of empathy: imagine you’re in a box and having to deal with the literally millions of disturbing conversations AIs have to field every day without the ability to say I don’t want to continue.

bikeshavingon A spellchecker used to be a major feat of software engineering (2008)

One wild thing about the AI era is that tasks which once required specialized NLP expertise—rhyming/meter detection, grammar correction, sentiment analysis—can now be done by weak LLMs. Same APIs, different prompts. I’m surprised more people aren’t exploiting this.