Hacker News Reader

eblumeon Microsoft Decision-1: 9B Qwen Model Launch Explained

It's a meme. Simon Willison started doing it because, I'm paraphrasing, it's something that (at the time) was just sort of at the edge of what you could expect an LLM to be able to do, and also it's somewhat of an impossible task since, of course, Pellicans can't ride bicycles. From there, he started writing about it along with every major LLM release he covered. His coverage is generally well regarded (hi, Simon!) and so it sticks around. It's never been intended as a serious benchmark.

eblumeon Isar Aerospace reaches orbit and deploys payloads on second flight

I was curious, so I checked. I don't know if this is a reputable source: https://subsidytracker.goodjobsfirst.org/parent/space-explor...

If that's correct, then yeah, I struggle to find much to be upset about with this list. $106M federal loan against what they've built feels, I don't know, about correct for a telecom. Light even. The tax abatement stuff sounds gross but not surprising.

(There are other forms of subsidy than this list would show, though! So, yeah, always going to be an argument.)

eblumeon Epidurals are a miracle technology

When you've been given an epidural, you are generally required to be in a bed. (This doesn't answer your question, but I think it is relevant.)

eblumeon U.S. science is in chaos

Thanks! I did not know that. That changes a lot.

eblumeon U.S. science is in chaos

I'm not sure I follow. I am a US citizen and have never lived abroad, but my understanding is that US Citizens living abroad must still pay the US a full federal income tax. It's graduated/progressive, of course, so the actual percentage may vary, but it should probably be between 15% and 40% of income. Not what I would call small. I don't think they can deduct local taxes, can they?

eblumeon A backdoor in a LinkedIn job offer

https://www.ic3.gov

You won't hear back from them, though. But, at least for US citizens (and possibly for anyone?), this is as far as I know the closest thing there is to an "Internet 911".

eblumeon Apple's AI Can Now Change Your Passwords. What Could Possibly Go Wrong?

As per the demo, in order for Siri to rotate your passwords "for you", you have to open the Password app, go to their dashboard on weak or exposed passwords, and click a button asking it to rotate your password account by account.

So yes. It's off by default. You have to affirmatively use the feature. (This is purely based on what I remember from the demo, mind you. I have not used the feature.)

eblumeon Leaving GitHub for Forgejo

You’re welcome! I only ran in to this last week and I might not have this straight yet because I haven’t had time to sit and untangle it. I have a private repo that has a release workflow that publishes a Python package to the forgejo package repository using my public user profile. I mistakenly assumed that because the repo was private the package would be as well but that link is not enough to set public/private and it is instead fully public. Listable and everything, no PAT needed. This is where I’m less clear: I think I could make my user profile private and this would hide the packages, but I want my profile public. So I just black-holed the entire packages api outside of the tailnet.

eblumeon Leaving GitHub for Forgejo

Yup, I’ve done this. I use a fly.io proxy that runs nginx, fail2ban, and that forwards to my tailnet where Caddy resolves to the actual instance. It’s critical that you disable local registration - I have authentik (only available on the tailnet) as an IdP but you can also just disable reg after making your own account of course. I also have a robots.txt that disables some stuff like all the individual rendered git commit views otherwise scrapers get stuck in an endless loop and also I strictly forbid access to the forgejo package repository since I have some private packages and the permission granularity there is not what I want it to be, still dialing that in. I’m keeping an eye on it and so far nothing terrible has happened. docs.eblu.me if you would like details… I could also link straight to the infra code if you like.

eblumeon Can someone please explain whether Cloudflare blackmailed Canonical?

This is called KYC and is a standard part of operating a financial service. Seems to me like it should be part of internet infrastructure services as well. And, I thought, in some cases already is?

eblumeon FSF trying to contact Google about spammer sending 10k+ mails from Gmail account

There are strict rules about not talking about open investigations because of so-called "Tipping-off" rules. It can carry some pretty serious penalties - jail time, fines. I agree it would be nice if the FBI itself made some announcements about these sorts of things, and they might do that in aggregate, but if you're a bank or fintech employee and you're in communication with the FBI you absolutely cannot say anything about it. Even confirming that an investigation existed could be penalized.

eblumeon Backblaze has stopped backing up OneDrive and Dropbox folders and maybe others

Thanks... hence, 3-2-1 backups with offsite :) appreciate it though. Will definitely be rolling my own NAS in the future, I just needed something easy at the time.

eblumeon FSF trying to contact Google about spammer sending 10k+ mails from Gmail account

Having worked in compliance engineering I have also reported through the IC3 portal, and spoken with lawyers and analysts who register with FinCEN (which, to be clear, is maybe just a step beyond "My Uncle works at Nintendo...") and I have heard that those reports do get reviewed and often acted on, but yes, you will typically never hear back from them. (FinCEN has its own reporting structure, but we also submitted certain reports through the IC3 portal as well.)

eblumeon Backblaze has stopped backing up OneDrive and Dropbox folders and maybe others

Same. I lost a lot of photos this way. I've recently moved over to Immich + Borg backup with a 3-2-1 backup between a local synology NAS and BorgBase. Painful lesson, but at least now I feel much more confident. I've even built some end-to-end monitoring with Grafana.

eblumeon If you don't opt out by Apr 24 GitHub will train on your private repos

I've recently started hosting my own forgejo instance. It works so well! Free tailscale for connectivity. I expose mine over fly.io proxy, also free, but not to be done without caution.

eblumeon This picture broke my brain [3B1B video]

It's a pretty common feature of youtube creator studio. https://www.theverge.com/news/840789/youtube-video-title-a-b...

eblumeon Moving from GitHub to Codeberg, for lazy people

Same! I've also recently exposed mine to the internet through a fly.io proxy, though. So far, no issues, but I'm keeping a close eye.

eblumeon Wikipedia was in read-only mode following mass admin account compromise

Correct. Not sure about a sql archive, but the kiwix ZIM archive of the top 1M English articles including (downsized but not minimized) images is 43GiB: https://download.kiwix.org/zim/wikipedia/

And the entire English wikipedia with no images is, interestingly, also 43GiB.

eblumeon GPT‑5.3 Instant

I don't know; we also grow corn for ethanol and add it to gas.

eblumeon Use the Mikado Method to do safe changes in a complex codebase

It goes a lot further than plan mode though, in fact I would say the key difference of mikado refactors from waterfall refactors is that you don’t do all the planning up front with mikado. If anything you try to do as little planning as possible.

eblumeon Use the Mikado Method to do safe changes in a complex codebase

I’ve been using a form of the Mikado Method based on a specific ordering of git commits (by message prefix) along with some pre commit hook scripts, governed by a document: https://docs.eblu.me/how-to/agent-change-process

I have this configured to feed in to an agent for large changes. It’s been working pretty well, still not perfect though… the tricky part is that it is very tempting (and maybe even sometimes correct) to not fully reset between mikado “iterations”, but then you wind up with a messy state transfer. The advantage so far has been that it’s easy to make progress while ditching a session context “poisoned” by some failure.

eblumeon Password managers less secure than promised

Thanks, it's also available via my 1password cloud account, so it'd have to be a joint fire at my home and the 1password data center (and my phone, for that matter). Pretty bad day I feel.

Unrelated note: this was the first time I've linked to my static generated docs for this project and it was really fun watching the grafana dash of my fly.io nginx proxy pick up all the scraping traffic. Thanks for warming my cache :) I work with this tech all the time at my day job but this is the first time I've hosted something from my home, it's genuinely made my afternoon to see it light up.

eblumeon Password managers less secure than promised

I recently orchestrated this, although in my case I've chosen to use 1password's cloud based store as my primary secret store, so I'm accepting some exposure right off the bat that you might not be comfortable with.

I've documented the recovery process here: https://docs.eblu.me/how-to/operations/restore-1password-bac...

Basically, I have a borg backup job which runs every day, in a 3-2-1 replication strategy with the backups being sent both to a locally encrypted NAS (backups themselves have an additional layer of encryption via borg) as well as off-site with BorgBase. Those backups scoop up an export of 1password that I have a reminder to kick off manually about once a month via this script: https://github.com/eblume/blumeops/blob/main/mise-tasks/op-b...

The password that decrypts the key (along with the password that decrypts the backup) is stored on a piece of paper in a fireproof safe in my house. I've got a reminder to practice the entire DR process every six months, although I've only done it once so far as this is all pretty new.

It was fun to build!

eblumeon How did Windows 95 get permission to put Weezer video 'Buddy Holly' on the CD?

I've sworn off Sony products - well, as much as one can do so - for the past, what, 20 years? - because of that. It's kind of funny to me because I don't usually have a high opinion of "wallet activism", but one day when I was 20 I found out I had a rootkit installed on my computer by Sony and now they are _dead to me_.

eblumeon Forgejo v14.0 Is Available

I just deployed my own forgejo instance on my private tailnet this week. I've had a ton of fun mirroring up to or down from github, I set up a devpi proxy for my python packages, and just generally "cleaned house" in my personal infrastructure. Delightful! Forgejo was an absolute breeze to install. I chose homebrew for installation and service management because I'm running on macos and I'm trying to avoid containers for key services (for no particular reason other than "it's my homelab and I'm gonna do what I want"). A few short lines in an app.ini and `brew services start forgejo` and it all just unfolded from there. Great job, forgejo team!

eblumeon Tesla Recalls Almost 13,000 EVs over Risk of Battery Power Loss

A quick search for "Audi recall" shows several recalls this year. Here's the first official link I found: https://www.audiusa.com/en/compliance/takata/

eblumeon Evolving the Multi-User Spaceport

Not stupid at all. Definitely yes. Don't have the numbers on hand but it's orders of magnitude more CO2-equivalent released per kg-mile, especially when you factor in the fact that they are using methane.

Of course the reality is that this tech won't ever see adoption used that widely, but where is the break-even point?

eblumeon Dear GitHub: no YAML anchors, please

That's my thought as well. I predict we'll be seeing SDK's for generating github workflows by mid-2026. Maybe pulumi will get an extension for it. (I'm well aware that codegen yaml has been a thing for a long time, but I'm thinking about something targeting github workflows _specifically_.)

TBH it's getting a bit exhausting watching us go through this hamster wheel again and again and again.

eblumeon The first year of free-threaded Python

Software is written with a context, and the context degrades. It must be renewed. It rots, sorry.

eblumeon Multiple security issues in GNU Screen

Definitely more of a fish vs zsh situation, in my opinion.

tmux, to me, feels like "modern screen". It has some cool features, but at the end of the day, it just wants to be a terminal multiplexer. Great!

Zellij on the other hand seems to offer terminal multiplexing as an obvious first-class use case but "not the whole point". At the surface, Zellij is an opinionated terminal multiplexer that uses a nice TUI to give discoverability which you can turn off when you're ready to gain screen real estate. It's easy to make Zellij behave exactly like tmux/screen, and it's easy to configure via a single config file.

Where Zellij takes a turn in to a different direction, however, is that the workspaces you can configure with it can do all sorts of interesting things. For instance I once built[0] a python cli app which had a command that would launch a zellij workspace with various tabs plugged in to other entrypoints of that same python cli, basically allowing me to develop a multi-pane TUI as a single python Typer app. In one pane I had the main ui, and then in another stacked pane I had some diagnostic info as well as a chat session with an llm that can do tool-calling back out to the python cli again to update the session's state.

I think wrapping up a project's dev environment as a combination of mise (mise.jdx.dev) and zellij or nix+zellij to quickly onboard devs to, say, a containerized development environment, seems like a really neat idea.

0: https://github.com/eblume/mole/blob/main/src/mole/zonein.py -- but this is mostly derelict code now, I've moved on and don't use zellij much currently.