Hacker News Reader

Wow I'm surprised, you're right, and it has happened before:

> the attacker issued and registered a free temporary 3-month certificate for the developers[.]kakao.com domain through SSL certificate issuer called ZeroSSL. Because the routing policy was already manipulated by the BGP Hijacking, the attacker was able to register the certificate.

https://medium.com/s2wblog/post-mortem-of-klayswap-incident-...

surroundon Is BGP safe yet?

The graphic that shows that a hijacker can route traffic to their malicious website is a little misleading. Since the SSL certificate would be invalid, browsers would block the connection and show a warning.

I guess the attack could still be used for denial of service.

surroundon X is selling existing users' handles

Your posts: https://twiiit.com/hac

2020 - "Ping"

2021 - "Pong"

2023 - "Boop."

2023 - "Bleep"

2023 - "will inventing new technology be the solution to our problems?"

surroundon Don't post generated/AI-edited comments. HN is for conversation between humans

Trust your own style, even if you aren't a native English speaker. Here's an example where a non-native speaker used an LLM to polish his post. The general consensus was that his own writing was preferable to the LLM's edited version.

https://news.ycombinator.com/item?id=45591707

For dyslexia, use a spell-checker. For grammar, use a basic grammar checker, like the kind of grammar checker that has come with MS word since the 1990s. But don't let a style-checker or an LLM rob you of your own voice.

surroundon Ask HN: What Are You Working On? (March 2026)

How do you know if it's real?

surroundon Let's Get Physical

Reminds me of "Story of a failed pentest"

https://web.archive.org/web/20181118010006/https://threader....

https://news.ycombinator.com/item?id=18475438

surroundon CBP tapped into the online advertising ecosystem to track peoples’ movements

> What You Can Do To Protect Yourself

> 1. Disable your mobile advertising ID

> 2. Review apps you’ve granted location permissions to.

I'm surprised they missed the most important step, which is blocking the advertisers from collecting your data in the first place. This is easily done in the browser with uBlock Origin and system-wide with DNS filtering.

surroundon Spotify won court order against Anna's Archive, taking down .org domain

Anna's Archive announced they intended to infringe on the label's copyrights by distributing their music without a license. The law allows the court "to prevent or restrain infringement of a copyright" (emphasis mine).

https://www.law.cornell.edu/uscode/text/17/502#:~:text=Any%2...

surroundon Spotify won court order against Anna's Archive, taking down .org domain

Wikipedia says

  Ek's initial pitch to Lorentzon was not initially related to music, but rather a way for streaming content such as video, digital films, images or music to drive advertising revenue.

So yes, they were always intending to get revenue from ads. And yes, the initial pitch included other types of media too. But I don't think we can call Spotify "an ad platform" that "never actually cared about music" any more than we could call Ars Technica "an ad platform that never actually cared about tech news."

surroundon I DM'd a Korean presidential candidate and ended up building his core campaign

Where does it talk about his use of English or his lawyers?

surroundon I DM'd a Korean presidential candidate and ended up building his core campaign

I can't find anything on his Wikipedia article for "English" or "lawyer." Can't we assume good faith?

surroundon Google's Genie is more impressive than GPT5

The leaderboard hasn't changed since it was updated to add gpt-5. Here's what it looked like yesterday https://archive.is/XIrbN

If you saw gpt-5 was ahead, you might have been looking at the leaderboard with style control https://lmarena.ai/leaderboard/text/overall

surroundon Google's Genie is more impressive than GPT5

You may have already figured this out, but the leaderboard you linked to (https://lmarena.ai/leaderboard/text/overall-no-style-control) shows gemini-2.5-pro ahead with a score of 1471 compared to gpt-5 at 1462.

surroundon Google's Genie is more impressive than GPT5

> The betting markets were not impressed by GPT-5. I am reading this graph as "there is a high expectation that Google will announce Gemini-3 in August", and not as "Gemini 2.5 is better than GPT-5".

This is an incorrect interpretation. The benchmark which the betting market is based upon currently ranks Gemini 2.5 higher than GPT-5.

surroundon GPT-5

GPT-5 knowledge cutoff: Sep 30, 2024 (10 months before release).

Compare that to

Gemini 2.5 Pro knowledge cutoff: Jan 2025 (3 months before release)

Claude Opus 4.1: knowledge cutoff: Mar 2025 (4 months before release)

https://platform.openai.com/docs/models/compare

https://deepmind.google/models/gemini/pro/

https://docs.anthropic.com/en/docs/about-claude/models/overv...

surroundon Ask HN: Have you ever regretted open-sourcing something?

> The purpose of Stallman’s open source movement

My understanding is that the purpose of Stallman's free software movement is "that the users have the freedom to run, edit, contribute to, and share the software." The FSF is focused on "defending the rights of all software users." Its about the users, not the developers.

surroundon NDA expired, let’s spill the beans on a weird startup

Sounds like https://news.ycombinator.com/item?id=27454589

"I currently have 10 fully remote engineering jobs"

surroundon Stockfish 14

chess.com ranks #195 whereas lichess.org ranks #1546 on Alexa's top sites.

https://www.alexa.com/siteinfo/chess.com

https://www.alexa.com/siteinfo/lichess.org

surroundon A Mindful Mobile OS

Previous discussion on the original article (447 comments) https://news.ycombinator.com/item?id=27456500

surroundon The 'Fuck You' Pattern

Try

https://libredd.it/

https://teddit.net/

surroundon The 'Fuck You' Pattern

Bibliogram is an unofficial front end to Instagram. Among other features, it won't prompt you to log in. Here's Ollie's page on Bibliogram:

https://bibliogram.art/u/polite_cat_olli_official

Reddit on mobile is also beginning to require logging in to view certain pages, in which case you can use:

https://libredd.it/

https://teddit.net/

surroundon Reddit’s disrespectful design

Try https://libredd.it/

Or https://teddit.net/

surroundon I was let go for refusing to deploy a dark pattern

It is a dark pattern - it tricks the user into thinking their data won't be submitted until they click "submit," but instead saves it right away. It would only not be a dark pattern if the form clearly said "your email address will be uploaded to our servers immediately after typing it."

surroundon I was let go for refusing to deploy a dark pattern

A dark pattern is tricking the user into doing something they didn't mean to do. I don't expect or intend my email address to be uploaded before I click submit. I expect it to happen after.

surroundon I was let go for refusing to deploy a dark pattern

A bit off-topic, but does anybody have any examples of websites which use this dark pattern? I am interested in trying to disable this "feature" client-side for the sake of privacy.

surroundon I was let go for refusing to deploy a dark pattern

If it's "pretty benign" to save a user's email before they click submit, then it wouldn't be a big deal to inform the user that you just saved their email instead of trying to silently hide the fact.

surroundon I was let go for refusing to deploy a dark pattern

The dark pattern is saving the email without informing the user or asking for permission to do so. Normally, permission is given when the user clicks "submit," but if you save the email before they click submit, it's a dark pattern.