doodlesdev

Only available to Google AI Pro subscribers. Google AI Plus hasn't got Gemini 3.8 Flash nor Gemini 4 Argon.

I find Dan Luu's blog extremely good to read on mobile, with great typography. The website also works with Firefox Reader mode and loads pretty quickly due to using the system's font.

Crazy performance and compatibility claims here. How is it that I've never heard of this project before?

Interesting feature.

I very much like Steam features aimed at helping me discover new games, since I find that nowadays I'm having much more difficulty navigating through all of the option to find something interesting to play, as I'm not investing as much time gaming as I used to when I was younger.

Any fellow HNers have cool suggestions? I keep hearing about Factorio and Satisfactory here, but not much else.

Related:

Ask HN: Is Firefox on Android Secure? - https://news.ycombinator.com/item?id=36671251

Site Isolation in Firefox - https://news.ycombinator.com/item?id=27196526

Improved Process Isolation in Firefox 100 - https://news.ycombinator.com/item?id=31355857

Apparently it doesn't contain a binding to the C library, but it does contain some compatibility and shares design decisions with it. In other words, it's not a clean-room implementation from the spec, but rather it's a port. Since this RCE is triggered by a OOB access, it's unlikely to have made it into the crate, but it's good to keep these things in mind.

Most microVMs run on extremely stripped down versions of Linux or NetBSD. Not the same thing as relying on PAM, SystemD, namespaces and cgroups to protect your application

Funnily enough, regarding SoftTalker's point, just a few hours after my original comment, CVE-2026-110264 (a CVSS 10.0... worse than PHP's RCE) rolled in for GitLab, which would be prevented by using a memory safe language to write the interpreter instead of C.

I don't use any of those for anything running dynamically on the web or accepting untrusted user data. Unless it is a quick student project, there's rarely a reason to do that anymore. It's also not the same thing, both NodeJS and Python with ASGI handle less parts of web requests than PHP is meant to.

Meanwhile, there are different threat models to any type of web application, it's just that PHP has repeatedly failed us in any threat model, same as C in most threat models that don't involve compiling it to WASM or running it air-gapped.

Leaving memory unsafe runtimes and interpreters directly available to public web traffic is a liability I don't want for me and users don't deserve to face the consequences of it whenever they are trusting you with their data. Rust and Golang even with all of their design issues should be the baseline for internet facing software nowadays.

As for the Linux kernel, everything I run on it is inside a VM (or a microVM) instead of relying on containers exclusively, because I can't trust a C kernel to not have vulnerabilities.

This might be one of the funniest articles ever. "Drupal is now light-years ahed of its reputation", yet it's vulnerable to one of the most serious and easily-exploitable RCEs in the history of computing.

It's time to abandon PHP and C-based software (i.e. PHP). The clock's ticking.

Crazy to think it's possible to access Opus 5 levels of intelligence for free. Of course, this is likely temporary, but something I believe a lot of students could make good use of.

That's correct, I've misquoted it. Although, if I understood correctly, it got released to all plans together today right? Or did AI Ultra subscribers have access to it since the first announcement?

There weren't "rumors" that it would be Ultra only, that's what Google has announced two weeks ago. Happy to see they've went back on that, but I haven't seen Gemini 4 on any apps till now, and I'm a Google AI Pro subscriber.

edit: just a few hours after this comment I got access to Gemini 4 on the Gemini app. Yayy! :)

Pi Zero has an order of magnitude extra memory and 3 times the CPU frequency. Likely to be enough, if emulator overhead doesn't compensate for it, although I think it could.

In that case, the Pi Zero 2 W ought to be enough, as its Cortex processor is leaps and bounds better, with a quad-core vs the Pi Zero's single-core, low IPC ARM CPU.

Crazy times we live in :)

Proton Pass cannot be self-hosted.

The thing is: availability of near-SOTA cheap Chinese models is forcing OAI and Anthropic to bring prices down and offer more efficient models, instead of simply focusing on super expensive SOTA LLMs.

I haven't really glossed over that fact, although nothing you've said here is factually wrong.

OP was talking about datacenters in residential areas and quoted the 90db @ 100m value, which indeed is 70dB @ 1km distance, which is absolutely absurd and would make it impossible to live nearby. That's the original comment I've answered.

Then, OP edited the post and said it was 90dB @ 10m, which means 50dB @ 1000m, an okayish value (depending on the type and duration of the noise), but that's not a distance we were talking about before.

I know datacenters in my city that are less than 500m from residential zoning (I should note I'm not in the US and this is not a new datacenter), so I didn't think that the original (distance) measurement sounded absurd, that's why I pointed out how much the (noise) measurement seemed to be out-of-scale.

Anyways, I think OP's measures where just completely made up or misremembered, because I'm any way I've framed the data (and the edited data), it doesn't match my personal observations around the few datacenters I've been to nor the data that's been released.

I did agree about the possibility of low-frequency noises being a huge nuisance, though, as those types of noises feel much worse than random noises at random intervals at higher dB.

I believe the biggest reason to use glass is that it doesn't react with much stuff, but I've yet to see an explanation for why your idea wouldn't work. I imagine there could be problems with autoclaves (i.e. degradation of the polymer) and fear of chemical leaching.

That makes sense, indeed. I've yet to see one of these new datacenters, but I've recently visited a hyperscaler's datacenter and most of the noise did seem to come from the outside ventilation.

I still heard almost nothing ~20m from it, but neither I (nor the company who built it) knew what kinds of workloads ran there and I suspect it was mostly traditional workloads.

   > I've read reports from people living near data centers having almost constant 60-70dB noise levels at their houses, which, yeah, it still shouldn't fly.

So, first of all, I agree, that's still top much. But I think it's important to point out that 60dB is, _literally_, 1.000 less than what OP was claiming (90dB).

I absolutely believe that there's leftover noise around the facilities, too, specially low-frequency humming for electrical equipment, but I have yet to see _actual_ reporting demonstrating newer AI-centered datacenters produce even near the amount of noise OP was claiming.

   > Noise level ~10m outside a facility is 90dB.

That would mean 130dB of noise inside the facility, which sounds (pun intended) impossible to me, no matter how bad the acoustic planning is.

edit: just understood what "Extra zero" meant. The original comment before being edited said 100m and that's what I was quoting.

   > At 100m, it often exceeds the 90dB threshold for hearing loss.

This is absolutely false. Those are the noise levels _inside_ the facilities. Noise attenuates by inverse-square law by distance. 90dB at 100 meters means 116dB at 5 meters distance... That's industrial alarms level of noise and would never fly in a residential area.

That's crazy awesome... I wish I'd had use for one where I live just to test it out LOL

   > robotic garages are everywhere

Robotic WHAT? That's crazy, if it's what I'm imagining. Is Tokyo that much crowded?

   > at the very least prompt you if they suspect prompt injection.

That's currently not reliably done the way LLMs have been designed. Claude's rejection to modify the file comes directly from Anthropic's understanding that training the model for this kind of refusal prevents huge mishaps.

In a nutshell, every prompt sent to the LLM is just text + multimodal input (if it supports it) + some reserved tokens.

At first, you could, for instance, create a token (such as the ChatML ones) that indicates the start of a system prompt and attempt to RL-train the model to not obey things after the end of a system prompt. However, fundamentally, the way LLMs work, you cannot guarantee that it won't see the user part of the prompt and obey what's there even though the system prompt told it not to. There's no hard separation between the control plane and the data plane in the LLM's context, so it's not a matter of adding more parameters or more RL training.

Using a guard model, or something like the auto-approval system on Codex or Claude Code nowadays, _feels like it helps_, but it doesn't fix the problem entirely since OpenAI's and Anthropic's models still have alignment issues all the time. We're not sure what architecture they're using, though, and it's probably still liable to the same kinds of mistakes.

It makes a lot of sense for the model to not be able to do it, whether you like it or not. In fact, it shows that Anthropic, despite all of their issues, are paying some attention to the risks of malicious prompt injection and models attempting to bypass restrictions.

If it could do it whenever you ask it to, it could also do it unprompted or by finding a file in your directory that told it to do it, which would make the entire permission system useless...

   > If you’re all “ra ra ra JavaScript!” you’re going to be shocked to find out what evil one can accomplish (either now or at various points in the past due to since-patched browser exploits or web platform security oversights) with just HTTP, HTML and CSS.

There's such a thing as an attack surface. JavaScript with JIT enabled has an attack surface so much larger than HTML and CSS that I cannot believe you're saying this in good faith.

Craziest thing is the mixture of:

- A browser engine outdated by two years, with known-exploited CVEs

- Chromium sandboxing completely disabled [0]

- JavaScript V8 Engine with JIT enabled [0]

For me, it's surprising we haven't seen more of these yet.

[0]: https://github.com/obsproject/obs-browser/blob/f555da02b1d59...

Fucking absurd. I'll forever hate developers who allow for such _bizarre_ exploit chains to happen. OBS is an OSS project which I believe has received a lot of love throught the years, but having the Chromium sandbox disabled due to authentication with _certain services_ not working with it enabled is asinine. Don't even want to imagine the other problems the project might have waiting to be exploited.

Sure, if the plugin developer sanitized the comments before inserting them, this wouldn't have happened _this way_, but having a browser engine two years outdated (for a reason which IMO is absolutely reasonable compared to other situations before) and having the Chromium sandbox completely disabled with nothing to substitute it is crazy in a software onto which people insert random plugins from the internet to get random functionality.

Hopefully those two changes ship fast to OBS. I may be supporting the project financially in the future if they update their security posture, as I'm generally very fond of OBS.

   > Opus 5.5 communicates more naturally than prior models. Early testers found its writing clearer and easier to follow, which addresses some of the common feedback we heard about Opus 5

Big, if true.