HNHacker News
TopNewBestAskShowJobs

truelson

256 karma · joined November 13, 2012

submissionscomments
truelson··on Ten days later, Git on macOS still trusts the compromised eMudhra certificates
I reposted this as it wasn't clear from previous comments with this URL that there's a patch that's worth running in there from Apple themselves
truelson··on Apple's git still trusts the compromised eMudhra certificates
Here's what apple (themselves) recommends to patch: https://support.apple.com/en-us/149555

Pretty much every developer on mac should probably run their patch.

truelson··on Broccoli2Shell: Brotli decoder RCE in Node.js, Python and more
So, uh, isn’t the blast radius huge here? Like ticking time bomb for unpatched servers huge once someone figures out how to craft their br payload just right?

Browsers were patched back in March, but if you can get anything else that is unpatched to decode br, and most HTTP clients do by default, and you’ve figured out the right payload (yes not easy, but still), isn’t this, well, really bad? Like Heartbleed big?

truelson··on How accurate have Ed Zitron's AI skeptic predictions been?
He is a bit more of a PR person rage-farming disguised as a futurist. He's not optimizing for correct predictions. That's really hard and not his incentive.

Look at his incentives. It makes more sense.

truelson··on Stop Killing Games
Not always planned obsolescence. Good ol' "only the cheapest survive" plays a role, too.
truelson··on One Brain to Query: Wiring a 60-Person Company into a Single Slack Bot
You're wiring up a number of critical systems... and prompt injection here could be really bad. I worry about such systems with a single point of contact
truelson··on One Brain to Query: Wiring a 60-Person Company into a Single Slack Bot
Just going to say it... no mention of handling the security aspects of this. Scary.

This is cool, I should say, but I would be really worried about the security aspects. Prompt injection here could be really painful.

truelson··on Show HN: Is Hormuz open yet?
Really liked this. Made me laugh even if not intentionally funny.

Also, given how markets and news cycles are moved with words not actions these days, I really like this site.

There are still so many misaligned interests; this is a much tougher situation that may get some local stability for a period, but will likely return to chaos again.

truelson··on Show HN: Skill that lets Claude Code/Codex spin up VMs and GPUs
Anyone use fly.io sprites for this yet?
truelson··on AI Bot crabby-rathbun is still going
Uh... i think Graphite (yay, stacking!) uses the API pretty heavily.
truelson··on ai;dr
My wife is my favorite editor. She's usually not available. LLM editor is fine.

Write it first, quick self edit, then have an LLM edit. Then I edit again. It's most definitely my voice, and I love it.

truelson··on An AI agent published a hit piece on me
Certainly possible, but this is all possible and ABSOLUTELY worth having alignment discussions. Right. Now.
truelson··on An AI agent published a hit piece on me
Are we going to end up with an army of Deckards hunting rogue agents down?
truelson··on An AI agent published a hit piece on me
You may indeed have a licensing issue... but how is that going to be enforced? Given the shear amount of AI generated code coming down the pipes, how?
truelson··on Frontier AI agents violate ethical constraints 30–50% of time, pressured by KPIs
Regardless of the technical details of the weighting issue, this is an alignment problem we need to address. Otherwise, paperclip machine.
truelson··on Google broke my heart
I'm going to channel a little bit of @patio11 .

First, worth reading this on how he deals with credit agencies and debt collectors: https://www.kalzumeus.com/2017/09/09/identity-theft-credit-r... . There's gold in here for dealing with big globo-corp and how to get their attention.

Ask Google for a certified mail address so you can send them the timeline of events that occurred. This is the shibboleth that lets them know you mean business and that by not responding, they may be facing legal action. DO NOT THREATEN or mention legal action. The managerial class doesn't act that way. Just signal you are building a case against them. Start with getting that certified mailing address... you may be surprised how they respond after just that request.

If they don't respond, keep following up. Send them a timeline of events, proof of ownership even if they do not ask you what you need to prove ownership. Make it clear what this is costing you.

But here's the thing, EVERY TIME I HAVE ASKED FOR A CERTIFIED MAIL ADDRESS, the globocorp gave me what i wanted, and I never had to follow up. Every time. They don't want to deal with actual legal action from "people who know what they are doing."

It's a shibboleth. Like "Baa-ram-ewe." Use it wisely and honestly.

truelson··on Street Fighter II, the World Warrier (2021)
Wired was such a great magazine to read as a teen in the 90s. I remember just itching for the next issue.
truelson··on Optimize for momentum
Snowballing. Sometimes it's ok to pick something easy, especially for a team, to get a small win first. If you're in debt, pay off the smallest amount first. Get the easy win. Build to the next.

And remember, you win by showing up each day, not by tilting at windmills.

truelson··on Work disincentives hit the near-poor hardest (2022)
If someone in the coming years ran on taking down regulatory capture and returning that as social safety net funding, public goods, and lower taxes, and had the chops to actually deliver, they'd do well.

Though best to start local government first, obviously.

We're reaching breaking points in so many places...

truelson··on Estimates are difficult for developers and product owners
"Evidence-based" stats tracking is the only somewhat scientific method i know of that can give you a good range of estimates. But it takes effort. Thus why many don't do it.

But accurate estimate ranges are a super-power for businesses if they can trust them. Never understood why that's not demanded more... oh yeah, it's work :p

truelson··on Estimates are difficult for developers and product owners
I preffered: https://www.joelonsoftware.com/2007/10/26/evidence-based-sch...

20-25 years later, this is still where we are at :)

truelson··on Netflix to Acquire Warner Bros
AT&T was able offload a bunch of debt on to them, and cash out at about what they paid in 2016. Not shabby.
truelson··on How elites could shape mass preferences as AI reduces persuasion costs
It’s still “new tech” to our monkey brains and it takes a long time, and probably a lot of destruction, before our we develop better cultural norms for dealing with it. Our cultural immune system has only just started to kick in.
truelson··on Arthur Conan Doyle explored men’s mental health through Sherlock Holmes
sooooo agreed. Just like George Lucas needed the original cast of Star Wars telling him no.
truelson··on It’s time to free JavaScript (2024)
Java no barter
truelson··on It’s time to free JavaScript (2024)
The ectoplasm name makes me want to make a "Don't cross the fs.createWriteStream()s" joke.
truelson··on Arthur Conan Doyle explored men’s mental health through Sherlock Holmes
But I did like how it started with Watson joining him to get a hit of adrenaline and not deal with his soldiering past. Was a great scene.

Also, re: Dr. Who, Moffat gonna Moffat

truelson··on We're losing our voice to LLMs
A friend of mine does this as English as second language and his tone was always misconstrued. I'd bug him about his slop, but he'll take that over getting his tone misconstrued. I get it
truelson··on We're losing our voice to LLMs
It's still an editor I can turn to in a pinch when my favorite humans aren't around. It makes better analogies sometimes. I like going back and forth with it, and if it doesn't sound like me, I rewrite it.

Don't look at social media. Blogging is kinda re-surging. I just found out Dave Barry has a substack. https://davebarry.substack.com/ That made me happy :) (Side note, did he play "Squirrel with a Gun??!!!")

The death of voice is greatly exaggerated. Most LLM voice is cringe. But it's ok to use an LLM, have taste, and get a better version of your voice out. It's totally doable.

truelson··on Bring bathroom doors back to hotels
Dave Barry having a substack was such a bonus find here
Page 1 of 3Next →