Unlurker|Replay|About
I never authorized an integration that scans my secrets (github.com/home-assistant)
•
So, wait, these are secrets that are already given to h-a, hashed, and just the first five characters of the hash sent up..? Yeah, I agree with the maintainer, this strikes me as outrage theater over any actual problem, no?
•
Here we have the classic if you want something to happen in the corporate world, make it go viral on the internet. Except, humans will be humans and it played out in open source. In this case, frenck most certainly backtracked because they realized they were on the front page of HN and did not want the heat.
•
>>please let us know so we can uninstall and fork >Sorry, these are not statements we can work with. Doing such threats and trying to intimidate it not going to bring you anywhere. If you want to do a just wanted to add an outsider perspective here, not trying to add wood to the fire but i don’t think it’s inappropriate or ‘a threat’ to let the dev know the user can stop using the software.
•
Is it inappropriate? Not really. Is it a threat? Yeah, it really is. “I’m going to stop using your software if you don’t change this” is a threat. “I’m going to fork it and ship a competing product” is a stronger threat. It was a clear attempt to sway with intimidation. It was done politely but that doesn’t change what it was. (The dev had already closed as won’t fix, too, so they had preemptively answered.)
•
Frenck here, I'm the one who replied on that issue. My replies there were more dismissive than they should have been. My apologies. I've posted a follow-up on the issue. As it turns out, the check can already be turned off after all: ha security options --pwned=false It has been part of the Supervisor for years and checks app options that are marked as passwords. A recent release fixed the warning that surfaces it, which is why people are noticing it now. Only the first 5 characters of a SHA-1 hash go to HIBP, and the matching happens locally: https://github.com/home-assistant/supervisor/blob/main/supervisor/utils/pwned.py Our documentation should have explained all of this, including how to turn it off. We'll get that updated.
•
> Only the first 5 characters of a SHA-1 hash go to HIBP Some would consider the first five characters being sent over the internet to be 'your secret leaving your system'.
•
why lying on your first reply? you mentioned 1Password did the same, in an attempt to make yourself "less guilty", but you failed to realize 1Password doesn't enable that option automatically without consent, and in some cases this option is periodically DISABLED automatically. address this, please, it's pretty embarrassing to lie like this just to cover y'all's ass.
•
From my understanding, they seem to be under a lot of stress/pressure lately. I'm not exactly sure why, but the stuff that happens tells that story (to me at least). Barking at frenck on a Friday at 11.30PM like this is probably not the right thing to do.
•
>As it turns out, the check can already be turned off Problem solved! >My replies there were more dismissive than they should have been What about this one?
The dev comes as self-serving. Not what you’d expect to see. Calls it heated when he himself caused it with their tone deaf response… it’s next level.
•
The same dev doesn't even like others packaging his open source libs. https://github.com/NixOS/nixpkgs/pull/126326
•
> The dev comes as self-serving What, do you not include links to every single one of your social media accounts in every single post you make on GitHub? I think this is a very cool and normal thing, and not a concerning red flag about narcissistic tendencies at all.
This feature has been around for 5 years... https://github.com/home-assistant/home-assistant.io/blob/current/source/more-info/pwned-passwords.markdown
•
The feature is not the problem.
•
That makes it even worse. A leak is still a leak even when you haven't notice it. Personally I use HIBP but I would still be annoyed to learn a system I installed mainly for privacy was sending private data to a third party by default.
It sounds like the dev's reason for rejecting the issue is that the issue was opened on the documentation repo rather than the code repo. On the one hand, it's understandable. No amount of documentation changes will fix the issue. On the other hand, it's a pretty abrasive response. It wouldn't have taken any more effort to be a little more helpful and direct OP to the right repo: "Sorry, this is the wrong place for this to be addressed. Please bring it up here instead [link]."
•
[delayed]
I wouldn't be surprised if that integration is outright illegal in EU due to GDPR, thus putting HIBP in trouble for ingesting PII without any legal legitimacy. And the first reply being "It is not an invasion of privacy" just shows incompetence on privacy topics. It is never a valid answer. Which is really concerning, for the lead developer of a home automation system that "fights for the fundamental principle of privacy" as per their mission statement.
•
What PII do you think is being sent to HIBP?
•
It's certainly an overstep, but just the hash they're sending wouldn't be PII.
•
I am curious thought that how it would be illegal according to GDPR. They are hashed after all, and the same hash is not used for authentication.
Toxic developers turned me off Home Assistant. The same developer is the star of this issue: https://github.com/NixOS/nixpkgs/pull/126326 Related discussion: https://news.ycombinator.com/item?id=27505277
•
Hah, his profile sure has a lot of bullshit about being human and positivity...
> If this is all reason for you to uninstall and fork... So be it, it is open source after all. what a petty answer. "just fork it bro".
•
Working on a fork already: Lets spend some tokens! :)
And that kids is a clear example of how not to interact with people online.
•
The developer's reply was very reasonable and measured. The user, on the other hand, was very rude.
I mean, none of them behaved like an adult. It's pretty clear that the maintainer should've handled it better but I'd be lying if I said I never felt like telling a petulant user off. The problem is he didn't handle it professionally.
•
Maybe he shouldn’t be accessing people’s passwords. If you start looking into someone’s wallet you can expect an abrasive response.
•
Well, I didn't check the git history so I can't confirm or deny that he implemented the feature, in any case, if you read the comment about how the passwords are anonymized it sounds pretty reasonable. Leaving that aside, even if you diagree with it you (the user) are not entitled to anything, especially not entitled to have an attitude. Just think about it differently, what do you think would happen if you do the same in the real world? I'm pretty sure in the best case scenario you may be asked to leave and in the worst case scenario you may be "escorted" out of the premises. A little bit of politeness goes a long way.
The Fatal Flaw of 911 (themarshallproject.org)
•
> Since 911’s inception in 1968, and even before, we have always defaulted to the police for things that really have nothing to do with crime. I'm not sure why that should be surprising. For example, I'd expect the highway patrol to show up first at an accident. Maybe an ambulance or the fire department would be there too.
•
Yeah I'm not sure the alternative would be better. You will always have calls that don't fit neatly into the "crime" "fire" or "injury" buckets. Of the three of those whose time I would want to take up dealing with something in the margins it makes complete sense for it to be a police officer, if for no other reason than there are a lot more of them than there are paramedics or [professional] firefighters in most areas. Downstream of that the potential negatives of having 1-2 paramedics dealing with nonsense and unavailable for other calls seem much higher than the negatives of having 1-2 cops unavailable for some period of time.
There is a difficult balance to strike in these types of calls (e.g. mental health crisis). On the one hand, the presence of police can escalate tensions and cause a situation to spiral out of control when it might not have otherwise. On the other hand, when a situation does get out of control, police are by far the best equipped to keep responders and bystanders safe. It can be a tough judgment call for responders to make
•
> police are by far the best equipped to keep responders and bystanders safe Are they, though? Increasingly, in the US, police are being trained to respond to any hint of danger with hair-trigger reflexes and lethal force. They are being taught to see themselves as constantly under siege, and every member of the public who's not a wealthy, able-bodied white person as a potential enemy, actively seeking to kill them. If I knew there was someone with a mental illness nearby that made them sometimes violent and unpredictable, the person I would want around wouldn't be a police officer. It would be someone who's actually trained to interact with the mentally ill and de-escalate situations. Sure, it might also be helpful to have someone who's physically strong enough to temporarily (safely) restrain the person having a psychotic episode, or a PTSD flashback, or just a plain old panic attack, to ensure they can't harm themselves or anyone around them while they are being helped . But if someone has one of those kinds of problems, and I'm nearby, the last thing I want is for a heavily-armed member of the Aryan Brotherhood with a badge to shoot them dead and then boast about it online.
Unless it’s changed recently, Bay Area 911 calls all get routed to CHP in Vallejo and they didn’t have any information of where you are if calling from a cell phone. Doesn’t seem fixed from a quick Google https://www.nbcbayarea.com/news/local/cellphone-users-in-oakland-dialing-911-routed-to-vallejo-chp/82399/
•
Maybe San Francisco should upgrade their tech to be on par with Kansas
•
Perhaps its time to get them onto the ESINet with a modern SIP stack and dispatch console. You can only kick the can down the road so far, this is an upgrade that has been clearly needed for many years.
The OS overrides location service settings during emergency calls > When using Emergency SOS to call emergency services, the call may include your location, regardless of whether you enable Location Services, to allow the dispatcher to assist you. https://www.apple.com/legal/privacy/data/en/emergency-sos/ Android has a similar feature. There is no legislation requiring this of device (or OS) vendors, but carriers are legally required to make location information available to emergency services, and I think are even prohibited from connecting phones that don’t make this possible. So market forces effectively ensure that all phones do this. The exception is when the call is too short to get a lock for GPS and location can’t be determined. The phone will still transmit what it can (say, WiFi proximity derived location). Worse case is fall through to carrier triangulation.
•
This is the correct answer.
Well, there's 311, for non-police non-emergencies.[1] New York City is serious about it, but most other places are not. [1] https://portal.311.nyc.gov/about-nyc-311/
•
Atlanta has it but our Mayoral administration has been hell-bent on rendering it useless: https://theappeal.org/atlanta-policing-alternatives-diversion-initiative-contract-violate-law/ I suspect Atlanta PD assumes the extremely meager budget (0.06%) for PAD is coming out of their very hefty cut of the city budget (30%+) and has been pushing against anything that smells like an alternative to their punitive model.
there are great books on the evolution of the retail side of policing. police spend most of their time responding to 911 and patrolling ( https://www.google.com/books/edition/The_Reinvention_of_Policing/_zGAEQAAQBAJ ) as part of a change towards reactive policing. how could it trend differently? you would have to come up with an alternative to 911 generally, which is very very hard. in terms of preserving 911 but improving outcomes, the strongest consensus among experts is that police need more specializations, much like healthcare. ultimately i think these problems exist everywhere in the world, and communities where homeless interacting with citizens & police issues are acute, like in san francisco, are actually the future, not the past, for other communities. coercion, like the kind that used to exist in California for the mentally ill specifically, is going away everywhere. it's not coming back. there are many ideas but ideas that are not going to be enacted are not valuable, even if they are interesting to talk about, and once you get a sober look at what really does get enacted and why, the problem shifts from the specifics of mental health and policing interactions to politics and getting elected.
•
>the strongest consensus among experts is that police need more specializations, much like healthcare. One of criticisms of healthcare is that we need more generalists so that people can afford basic checkups and routine care without obscene expenses. The call for more specialization might only serve some small minority of cases at wildly out-of-proportion rates. Part of why policing seems so ineffective is because, whether or not it was deliberate, police forces have mutated into the "drug money confiscation force". Most people do not have active problems caused by or aggravated by drug dealers, and certainly not to the degree that would be indicated by how much police effort is expended toward those criminals. When real crimes are reported, we're told "tell it to your insurance company", the police never investigate, solve, or prosecute the people who commit those crimes.
I'm honestly amazed someone could point to San Francisco's homeless problem and its policing or lack thereof and say "that's the future"
•
there is a certain kind of mook ( https://ribbonfarm.com/2020/01/16/the-internet-of-beefs/ ) out there: he finds a community in the United States, or who talks about communities they've never lived in in East Asia, like Singapore, or talks about communities that lack free press or elections and therefore verifiable statistics, like most of China, or are closed communities, like some of the EU, who says: "If we only did X like they do in community Y, there wouldn't be problems!" And what I am saying is, not that San Francisco does things well, but that the homeless problem in San Francisco is coming for those communities too. They are in San Francisco's past. Drugs are coming for those communities, the K shaped economy is coming for those communities, expensive OT-based compensation, a bloated public sector, falling commercial real estate, NIMBYism, private schooling, way too intensively used roads... Obviously, a lot of good stuff is coming too - Section 377A was only repealed in Singapore in 2022 - but my point is that nobody gets it right. They are just behind in a certain sense of getting it wrong. To fix policing, you have to look at things like a Darwinian system, rather than looking for antagonists or agonizing over statistics.
In the US, 911 is treated as a generic "emergency" dispatcher. I don't have stats handy but am pretty sure 911 calls are at least as likely to result in an ambulance as a cop (or fire truck).
•
Yes. This article’s main drive is that because organizationally the PD often (sometimes? Idk) runs the PSAP where calls are received, that they have a bias toward assuming a cop is the correct responder. I actually disagree with this. The reason why people call police is that they know that the so-called “mental health crisis” is extremely dangerous, in a physical way, not just “emotionally triggering.” Like the dude I saw on the news in NYC last week who was lunging at the police with scissors who eventually ended up shot after the taser failed to get him to stop. I guess people would like to believe that there’s an army of well-trained social workers out there who could be dispatched to the scene to simply talk someone down from a total psychotic episode, but the fact is that the type of person who’s going to be shot by the police would’ve also stabbed the social workers with scissors too. The reality of the matter is that people who are severely mentally ill can be very dangerous to others. There’s not an easy way to guarantee they’ll never come to harm unless you’re willing to sacrifice the safety of everyone else by renouncing any possibility of using force.
You understand that 911 is a central dispatcher, not to the police specifically, right? That they default more to the police is a completely different issue. And I much prefer only having to worry about remembering 911. In Norway I'm supposed to remember to call 112 for the police, 110 if there's a fire, and 113 if I need an ambulance or am having a medical emergency.
•
Oh great, because in Germany it's exactly the other way around. 110 is police, 112 is firefighters and ambulance.
> American cultural dominance has made it so everyone knows 911 and even Europeans apparently end up dialing it. This is a ridiculous opinion.
•
It’s weird that that opinion occurred in a comment where they already knew about the reverse decision. It’s more of a case of pragmatism than cultural dominion. I suppose they think that if America didn’t have so much cachet, that calls to 911 in Europe should route to a recording of someone chewing you out (in whatever the local language is) for being a cultural imperialist.
I had a weird thing happening with that. I just returned from dinner in Germany driving through a semi-industrial area in the netherlands when I spotted a fire in one of the buildings we drove past. I called 112 and was connected to the German dispatcher and they couldn't connect me to the Dutch fire department. So they sent the German firetruck across the border and meanwhile alerted their Dutch colleagues as well. Apparently my phone had not yet re-registered with the dutch network even though we were already well across the border.
•
That’s super cool of them. I guess fire is one of those things where jurisdiction doesn’t have to be exact. And with the lack of physical border there, they could easily just hop over and do their Dutch colleagues a favor.
•
I mean they were possibly going to help anyway or even physically closer. And I imagine that sitting around in the fire department does get boring, something to do occasionally is welcome :)
How the Claude Code team does code review (claude.dev)
•
Mfw tui needs a billion prs per day. Opus 5.5 is obviously stellar but come on what are you doing lol
•
Before all came to this, I've been promoting reviews at $dayjob not as gatekeeping but as method to exchange information and build more team spirit. We are an internal service team working by "projects", which makes us a very disjointed team with barely any communication. (Part of it is also German work culture.) And now this. Suffice to say, my efforts did not bear fruit. I feel more isolated than ever before.
I saw someone say the other day (in response to another blog post being well written) that Anthropic employees have a rule against using AI for writing/external comms? That seems clearly not the case here, normal people don't write like this: > Most of the path is automated; a person's attention goes where the risk is > The eval grows with every incident, and every change to the reviewer is scored against all of it.
•
this definitely seemed like something claude generated, i know because i frequently do all my research in chat and then ask it to generate a doc based on what we talked about and when i read what it generates the verbosity, the style it writes in makes me delete the whole thing. I would never subject readers to that.
•
Pangram reports 80% of the text is AI-generated: https://www.pangram.com/history/72309aad-6e3f-4002-bdc5-c062891732aa
•
100%, although if people are getting 90% of their interaction from a robot, one may start to pick up some vocal tics and colloquialisms from machine world. a kind of robo-pidgin.
No wonder most people at Anthropic believe our jobs are in jeopardy, they've already made a system wherein the machines are treating them like pets. I really don't get the tendency here from Anthropic to describe what's most likely churn? 1000 "PRs" a day on a TUI to wrap a while loop? I'm not going to be a reductionist here so I'm going to cut it off there, I'm positive that the complexity of handling multiple terminal emulators is something that needs some handling (even if doing their own rendering engine was a self made problem). Yes I've vibe coded my own harness from scratch without writing any of it, I still know how it works. I'm also not sure that they addressed point 2 in any actual capacity? They say "the system verifies itself" which is cool and is something that automated testing has done for decades, but they eschew the mental model of how the system works as a whole and prefer instead to have the LLM focus and summarize a slice of the system when they need to know about it or ask for it. But.... That's not knowledge? That's just search a la google? And thus seems to be subject to the same problems where the quality of your search dictates the quality of your knowledge that you surface at any given time?
•
> I really don't get the tendency here from Anthropic to describe what's most likely churn? 1000 "PRs" a day on a TUI to wrap a while loop? From the article, the 30,000 changes a month are in the monorepo, and Claude Code is in a separate repo. So it’s not the TUI that has 1,000 PRs a day. I could easily see 1,000 PRs a day on the backend. Big tech was doing more than that pre-AI.
•
> wherein the machines are treating them like pets I know some people will groan hearing the phrase again, but: "Reverse centaur." A centaur is a synergistic combination of two things, but now those things are in the wrong position: The human is the computer's tool. Naturally, how "wrong" it is tends to depend on whether you ask the people who do all the work or the people who own all the computer-capital.
i am tired of listening about other ppls agent setups. Everyone thinks they've discovered something cool and unique but They are all the same. Its like telling other ppl about your dreams. Not interesting.
•
For real, my eyes completely glaze over, there is nothing interesting in it.
At 30k commits a day, is there anything that can meaningfully be called review?
•
I dont believe it, its FOMO marketing to me.
•
It's conducting/steering/oversight/supervision, not reviewing.
I'm thinking about high volume mass manufacturing as an example here. I like those "How it is made" type YouTube videos. You see a production line that has some kind of QA process where cameras + automated systems do spot checks at high speeds and these crazy actuators are punching out bad examples. These processes often also involve spot checks where some statistical sample is selected and viewed carefully. I don't think we've gotten to that level of reliable review with code, but I don't see any reason we can't continue moving in that direction.
•
Those machines are not doing design work. They automate production of designs that had long development and testing lifecycles. Code is design. The compiler is the automated production process.
That’s a category error. Software isn’t stamping out the same part again and again; if it were review would be simple. Analogies often mislead. Of course Anthropic would love you to think you are heading towards that future so we have to bear in mind their livelihood depends on LLMs being the future of work and 30k changes a day being normal. But why would we want 30k changes a day in a given product, what possible justification could there be?
•
I understand the skepticism and I can't claim I am right. But some points come to mind. First, I think we overestimate how different code is from other code. We even joke about CRUD apps and how cookie-cutter they are. A lot of changes in those apps are: add some new features to a data access layer (SQL, ORM, whatever), add new routes, add new UI surface, etc. There is an entire industry around "Design Patterns" and people live by the DRY axioms. Things like Ruby on Rails exists because rebuilding these systems over and over is wasteful. I feel we are just moving further down that same path. Second, your question of "why would we want" is totally backwards. Progress doesn't follow your desires. Progress doesn't require justification. Sometimes we adapt the environment to our needs, other times we adapt to a changing environment. Which case we are currently in is still undecided and you are free to fight for the future you prefer. But demanding an industry justify itself before it is allowed to change fails in the face of evolution. If it works, we will justify it in hindsight.
Anthropic has been profitable for the past two quarters.
•
“I think that, every time you see the word EBITDA, you should substitute the words "bullshit earnings.” ― Charles T. Munger And what they're reporting is adjusted even further than EBITDA
•
"Anthropic told investors that it will profit on a measure called adjusted operating income. "According to the report, adjusted operating income excludes stock-based compensation, which is not unusual for technology companies. However, the report also quotes its gross margins - above 80% - exclude revenue shared with distribution partners, as well as the cost of training its models." From https://www.morningstar.com/news/marketwatch/2026091414/the-very-big-caveat-to-the-report-that-anthropic-is-profitable-for-a-second-straight-quarter
•
I wonder how they account for free credits given in this spend. We got given US$5k free API credits from them a couple months ago and even accounting for our Claude Code subscription spend, I think we're still ahead overall - they haven't made any money from us! And they just gave us another few hundred bucks a month of API credit as part of our subscription.
How is the ability of a human to understand the code via hands-on familiarity not a direct dependency of their ability to do manual code review? I don't get it. Having claude write an explainer (something I do a lot!) doesn't get you to the point where you can confidently assess a complex diff. And you've funneled your priors on what the diff says and does through the same system that already reviewed and approved it. This article isn't bad but it doesn't give enough weight to the human context-building part of the problem.
•
Yes it used to be said, the code is not the asset, the people who know what the code does and how to change it are the asset. Now we’re just going to outsource our capacity to design and review because it’s faster that way, as if the thing that was wrong with the software industry was that releases weren’t being pushed out often enough.
Issue: I am still unable to stop myself from doing line-by-line code review Response: Try experimenting in a low stakes environment From Google: "Exposure therapy is a psychological treatment designed to help people confront their fears, break cycles of avoidance, and reduce anxiety."
•
No. The issue is: "I notice too many things (redundant code, duplicate code, overly complex architecture, etc.) during review" How does "low-stakes environment" fix that?
•
Because one may learn that those fears are overblown. Or they may learn that they cannot build any kind of software without reviewing every line of code. The person is saying "I am still unable to stop" and that is most likely because they feel a sense of responsibility. If they choose a project where there is no responsibility, where it literally doesn't matter if the project fails, they may feel able to stop. And if they manage to make that project work, if they can succeed, then they will build up confidence. It seems better to be able to work both on projects where they review all code as well as projects where they do not review any code. In fact, keeping their job in the long term may (or may not) require having both skills.
•
I guess they’re just saying “you’re holding it wrong” Last time I chose to vibe code, I did it in a language I didn’t know so that I wasn’t tempted to try and comprehend the choices the robot made. I ended up with the application I wanted. Caveat: it was code I would never have to touch again, I ran a script to generate the 140,000 static html pages that the rails app provided and then just uploaded them all to R2 buckets (million reads per month on free tier)
The thing is that's not an issue in the slightest, it doesn't need therapy!! It's those who don't do it who'd need a talk..!
•
I think that depends on where you work. If your company demands that all code is reviewed then anyone who doesn't do that should be spoken to. However, I suspect there are teams that are making different choices. In the most obvious example, I can do whatever I want on my personal projects (I hope you agree). And if I started a business and hire in programmers, I have some expectation on defining the culture, making hiring decisions based on my preferences, etc. Whether or not such teams succeed will be a matter of fact, which I do not believe has been decided at this time.
•
I hate to say this, but you're now living in a world where the value of artisanal code is rapidly approaching zero. If you still cling to beautifully written code as your core qualification, you're having a rough future ahead of you. And I say this with the bitterness of someone having lost a big part of what made me enjoy this line of work.
I think the intended takeaway is to learn to solve those problems without line by line review. Start by being hands off on a low stakes project, and see how the model fails. Then, come up with, and try, solutions that aren't you doing archeology.
•
This somehow assumes that the person above doesn't already do all the magic the people say work 100% of the time, and finds these issues. How does running into literally the same issues in a low-stakes project help?
•
I think it's a good assumption. Their comment implies they aren't harnessing the coding agent very strongly given the failure modes they mention. Do you think it's better to experiment with high stakes projects? Do you think it'll be easier to avoid defaulting to line by line auditing of a project that is high stakes?
I haven't had this issue since like last year with frontier models. What are you using?
•
All the models do this. I'm literally right now watching Opus 5.5 duplicating code even after telling it to fix duplication.
•
-
It’s only about 10 per engineer. I’m not at Anthropic and before 2026 I was regularly hitting 1400 commits / year on my GitHub. If agents made me 2x faster (they have, review is still slow; I currently have 40 PRs open) that’d be the same rate.
•
> 40 PRs open Ah, so you've privatised the benefits and externalised the costs.
Claude reveals ECDSA curve origins (anthropic.com)
•
About a month ago a friend told me that he had as significant number of free Anthropic credits that were about to expire. I do not use their products because of their relentless commitment to depriving the public access to artificial intelligence and I strongly discourage anyone else from doing so. But since he was going to use the credits for something, I tried to think of a skut work task that would be of only idle curiosity and would not help advance misanthropic's capability, enable a meaningful public announcement for them, and was likely already probed by many others (so success would only be lottery effects). So I recommended determining the origins of ECC seeds and base points. The agent worked continuously for days and did not uncover anything interesting that wasn't already known. I looked at the transcript and was struck by how idiotic the agent was-- significantly below the standard of intelligence I've come to expect from GLM running locally. I'm not saying this to suggest that misanthropic hijacked someone elses work yet again-- this is an obvious question that many people have surely posed and success presumably depended on expert use (which was absolutely not applied in my friends example). But it does make me wonder if the company invisibly degraded the model performance.
•
crazy
So it’s pretty clear that Anthropic is privately trying to break cryptography.
•
I see it as, they're all trying really hard problems that aren't in the training data, to gauge if their models are improving, with both achieved by looking at problem that humans haven't been able to solve yet. The evidence to this is everything being released in the last few weeks.
On the face if it, the big leap here was Claude autonomously envisioning, and deciding to pursue, the "ancient prng + date" angle - - rather than working backwards from the premise of deliberately weakened seeds or some other popular theory. To me that shows creativity, and modelling of the situation and method of the people at the NSA. So two questions: 1. TFA mentions the "humourous phrase hash" theory, but Claude's trajectory seems to be a long way from that. To what extent was Claude prompted in the ultimately successful direction? 2. Whats with all the "hmm..." in the internal reasoning process log? Do models really do that? And if so, why? Some weird emergent language thing, or just mimicry?
•
> the "ancient prng + date" angle I remember hearing this in a cryptanalysis lecture at some point, so it was not a completely novel theory. Admittedly I am not finding written evidence of this anywhere.
•
> 2. Whats with all the "hmm..." in the internal reasoning process log? Do models really do that? And if so, why? Some weird emergent language thing, or just mimicry? Assuming that is actually the real reasoning trace (open weight model reasoning traces usually do things like switch languages or talk in non-standard English because of model drift, so it's a bit surprising that Claude wouldn't do the same) there was a study a few years ago that found base models produce better answers if you put "take a deep breath" in the prompt[1]. Maybe in the RL training stage stuff like that gets reinforced and because reasoning traces are hidden in RLHF it doesn't get selected out? My money is on it not being the real reasoning trace though. [1]: https://arxiv.org/abs/2309.03409
The process to generate these was opaque, so there was some concern that the values might have been backdoored somehow like Dual_EC_DRBG was; we didn't even have confidence that they were generated from a PRNG rather than some other process. Knowing that the values were generated this way makes it much less plausible that there is such a backdoor.
•
But you can still analyse the behaviour of the values to identify backdoor behaviour rather than insisting on uncovering the exact method od generation. Just seems to me like that's quite low on the priority list. I guess this result assures some people that the values are good.
Very well possible. I’m glad to see that this is all above board in the end, which further argues the case AGAINST conspiracy theories. Most people are just trying to do the right thing.
•
Sorry, US intelligence agencies is not a category of organizations I would sort in the "we're just trying to do the right thing" bucket. I dont even mean that as a dig to the people working there (although maybe some) they're literally a military wing of the worlds most powerful empire.. Lets be honest with ourselves, their job is to spy on people, and spies try to make their job easier not harder. Hell it seems they did lie about the origins, which should bring their entire motivation into question. They spread rumors that it was a "silly phrase", thats ridiculous.
Yep. NIST closed it: https://www.muckrock.com/foi/united-states-of-america-10/origin-of-fips-186-4-elliptic-curves-over-prime-field-seed-parameters-national-institute-of-standards-and-technology-78756/ NSA ignored it: https://www.muckrock.com/foi/united-states-of-america-10/origin-of-fips-186-4-elliptic-curves-over-prime-field-seed-parameters-national-security-agency-78755/ I think part of it is I don't know how to write these FOIA requests in the right way they can comply with it. I think you need to be more specific.
•
thank you for at least trying :) starts to rebuild trust at least :) what's one thing that you can actually talk about out of this that might help people to understand that's getting lost?
If you keep posting like this you're gonna get microwaved from space ;)
•
I'm only posting like this because they already are.
The number of weak classes of elliptic curve would have to be gargantuan for this specific search to produce some. If that many curves are bad, then ECC was a mistake.
•
Then why not turn this around and say which (hopefully small set of) specific classes of curves are known to be avoided, but otherwise have a free for all? > If that many curves are bad, then ECC was a mistake. I mean that is the logical conclusion from the behaviour around this approach where a few good things are effectively endorsed without justification. The fact is any application of an algorithm that involves so much "trust me bro" on the selection of what are a large number of opaque quasi random but not quite or provably so numbers only has as much trust in it as you have in the people that created it.
•
drand48() could be one of hundreds of methods that were tried to produce specific values with plausible deniability and happened to produce them. The other searches were discarded.
> This is not a cryptographic break, new attack, or weakness in the ECDSA curves. In fact, this makes us more confident the curves were chosen without any backdoors or intentional weaknesses. Uh… did you talk to any cryptographers? This is EXACTLY what a weak curve would look like. Imagine that 1 in a thousand, or one in a million keys, selected at random, are vulnerable to some withheld attack. This approach lets you vary the timestamp or number of iterations until a weak key is found, then have plausible deniability afterward. This is why modern systems choose constants in a way with no free choice of parameters (e.g. sqrt of 2 for first constant, cube root for second constant, etc.). They even note later in the article that viable curves in the generator sequence seem to have been skipped.
•
Yes. I did speak to a cryptographer.
Extremely unlikely - these are very sparse domains.
•
Somebody must have tried attacking old lost Bitcoin wallets on that basis. But so far those early day Bitcoins haven't moved.
I understand Spanish being from Latin America but for a long time I couldn't understand a single thing he said because of the Spaniard accent and crazy laughter, and I enjoyed the memes just fine. But then few years ago I watched it with the real subtitles and something clicked in my brain so now when I watch it I mostly understand him fine. But now the memes are ruined because it's hard to hear and read two speeches at the same time. Just an annecdote about our weird brains.
•
Just to add here that this guy doesn't have a "standard" Spanish accent. He was from Andalucía (I don't remember where exactly), a region rather known for its accent being difficult for even native speakers to understand. Anyway after I moved to Andalucía I now can understand the story he tells, but I have to pay close attention!
Video is meant as a joke, it’s common to edit the subtitles of this video to alternate ones
•
Tptacek is an expert in this field. I imagine he's had to spend a considerable amount of time explaining why ECDSA probably aren't nerfed.
This neat and all but I think there's a bigger issue here. Anthropic (and whoever Anthropic wants) can do this kind of work with Claude, but if you or I try to do it, we will get blocked. This is a fun exercise, but extend this to something much more nefarious and you can see a moat widening between the model providers, their government partners, and the public. The only thing that bridges this moat is continued advancement of open models.
•
As much as I dislike the guardrails, they are absolutely irrelevant to this task, and you will not get blocked.
•
Why would you be blocked? I cannot imagine why you would be for this specific task unless the supposed backdoor turned out to be real.
French Revolution and the 21st centuries version of guillotines, whatever that could be, is probably a good reason to avoid that. There's also a thing called commodity fetishism but capitalists usually learn the hard way that things created with machines without human input miss the essence of why we're willing to pay for something. Its why a handmade watch is $100k and a casio is $100, or a handmade sweater identical to a machine made goes for 10x. They could also just make us so poor and anxious that we beg to fight eachother in wars.
•
Another labor theory of value patient.
•
Gun to your head, you have to see one of two movies with the same plot and characters. They are identical movies. One is produced by 500 humans collaborating and the second is completely generated by an AI that can actually make a movie A single individual or small group of people who own the GPUs profit from the AI version, and the human version provides a salary to 500 humans/families. Which one are you buying tickets for and choosing to spend 2 hours watching?
What else should we do? It's not like we had any choice.
•
What? You have the choice of just not . Or if you absolutely must to put food on the table, you don't need to fucking cheer as you do it!
•
This is a risky proposition if the technology is in some way revolutionary. The people who decided to "just not" with, for example, the internet often aren't doing business anymore.
I mean I want this to, just don't get your hopes to high because it's not long till they get dashed. I don't think it will be too long before models are considered munitions and having the weights for one will require registration.
•
I lived through PGP encryption being considered a munition and printed in a book to evade munitions controls. Print the weights out if you must and publish them in a book I can slice the binding off and digitize (the meta irony is not lost on me). Same way you're not going to stop someone from 3D printing firearms. “When open weights are outlawed, only outlaws will have open weights.” https://en.wikipedia.org/wiki/Export_of_cryptography_from_the_United_States https://en.wikipedia.org/wiki/Pretty_Good_Privacy#Criminal_investigation https://openlibrary.org/books/OL783800M/PGP_source_code_and_internals
> I cannot figure out how to as an individual or a small startup request elevated permissions… https://support.claude.com/en/articles/14604842-cyber-verification-program#h_3aad573b51 https://portal.anthropic.com/programs/cvp
•
"No." Dario keeps saying in interviews that AI hacking is not a problem because "the good guys will protect themselves with AI", but then gate-keeps. I submitted the form and it was rejected without reason. Now what?
Because this is how the world works An LLM isn't a book. You can still go buy the books you want. An LLM, especially as they get more advanced, are agents. You can ask them do to things and they can interact with tools to do things. You're free to print a cocaine book. You're not free to incorporate it into a cocaine making machine without violating numerous laws.
•
You are entirely free to build a cocaine making machine in most countries. It is actually using it to produce cocaine that is a crime. In reasonable countries, this is exactly how it works. You can own lockpicks, practice picking locks, and even publish detailed instructions on how to pick locks. It's only when you pick someone else's lock that a crime is committed. Limiting access to tools and knowledge benefits the wealthy and privileged. Knowledge should proliferate, that is how the world has worked long before I was born and god willing that is how it will work long after I die.
•
You are entirely free to build a cocaine making machine in most countries. It is actually using it to produce cocaine that is a crime. In reasonable countries, this is exactly how it works. You can own lockpicks, practice picking locks, and even publish detailed instructions on how to pick locks. It's only when you pick someone else's lock that a crime is committed. Limiting access to tools and knowledge benefits the wealthy and privileged.
•
I have some bad news for you about what happens if the cops find you with lockpicking tools.
•
You can program a computer to do things and they can interact with tools to do things too. Doesn't justify restricting what you can do with them. If you program a computer to make cocaine for you, you're the one violating the law. If you ask an LLM to do the same for you, you're the one violating the law. The LLM's capabilities are irrelevant.
> There is very much a situation where people in frontier labs have access to exceptional capabilities that are being kept from the rest of us, and they're using it to strip-mine technical and scientific problems. If these capabilities were available to the public, someone somewhere would make a biological weapon or create a virus we've never seen before that could kill many millions of people. Stanford researchers have demonstrated it’s possible [1]. [1]: "AI creates 16 new viruses from scratch, showing promise for drug resistance and drawing warnings about potential for misuse" - https://www.cnn.com/2026/08/06/health/ai-viruses-bacteriophages
•
Biologists already addressed this idiocy a few weeks ago [1]. Making a biological weapon requires facilities that only some nation states and comparable companies, have access to. AI isn't going to magically assemble a DNA sequence for you and a computer design is not a guarantee of something that works. AI restrictionists love to pretend that their toys will, with the power of intelligence, magically bypass fundamental limitations of reality to conjure up fantastical weapons of mass destruction if they throw enough computers at the task. Unfortunately for them, that is not how the world works. [1] https://www.businessinsider.com/researchers-ai-apocalypse-skepticism-lethal-virus-real-world-barriers-2026-9
We already have controls for that: we control access to the reagents and equipment needed. Yknow, like we always have. Information is not dangerous. This is a ridiculous argument to me, but maybe my chemistry degree has me biased.
•
Not to mention that making an actual novel virus requires thousands of dollars of equipment, serious lab skills, and even then is so dangerous that the wannabe terrorist is more likely to infect and kill themselves than cause mass causalities. It's the equivalent of making pipe bombs at home. The instructions are out in the public, but that's not a problem because the idiots that make pipe bombs blow themselves up more often than they succeed in doing terrorism.
Llama.cpp on a jailbroken PS5: run any GGUF model natively on the console (github.com/cobanov)
•
Kinda cool but also entirely useless given the limited VRAM. The readme oversells it by pretending it would be something actually usable, when instead it is a cool achievement to make it happen.
Well that locked-down appliance is way under-specced compared to an equivalent build at the same price.
•
Even at the current increased prices - you can build a PC with a better spec and with a 4K Blu ray drive for £569? I'd be curious how.
•
Does that remain true in the RAMpocalypse?
Just opened up eBay and they're going for like $200 here, $220 if you want a "modded BIOS" (whatever that means).
•
Flashing the bios takes ten minutes with a thumb drive. It’s hard to get wrong but guess some people would be nervous enough about that to pay $20 extra.
There's no feasible way to avoid takedowns/DMCA in 2026 unless you do TOR shenanigans. Even with a custom domain, Sony could just DMCA the web host for the project.
•
Torrents. Got the leaked GTA6 videos by torrenting and they're still easily available on public trackers. Don't see why projects like these couldn't be distributed similarly if shit hits the fan.
Significantly slower and less capable than opus 5.5 However you can run comparable or better models than gpt4. Try to stay under 30b
•
GPT-4 and Opus 4.8 were the models that started the AI craze. Now people look down on them.
With this in mind, having LLM-powered NPCs would be a beautiful thing. There's been limited testing on PC games (PUBG Ally), but I can imagine it will be the standard.
•
After all of the agonising about AI companions, we realised that we just wanted someone to play games with.
eBay Restricts Listings of Radio Equipment, but Exempts Ham-Band-Only Gear (arrl.org)
RF usage is governed by the FCC. Amateur Radio exists at the mercy of the government, and if there is widespread abuse or careless operation by amateur radio operators then that will likely jeopardize the continued existence of amateur radio.
•
there are more kinds of governance than command-and-control only. I concede that some legal relationships are command-and-control. Physics itself and jurisdictions.. not sure but I think Nature bats last
•
Amateur Radio predates the FCC- so I almost think it should be the reverse, none of this at the mercy of stuff. Of course government is the real coercive force- in Germany the Nazis revoked ham licenses, racially purified radio clubs and made the amateur radio operators work for them.
It is very strange that when you come across anything radio related, people seemingly come out of the woodwork to tell you not that you are necessarily, actively doing something against regulation, but that there is always potential to be breaking the law. Take this Hackaday article from the other day: https://hackaday.com/2026/10/15/so-you-want-to-make-your-sdr-work-on-other-frequencies/ The subject is mostly academic, but in 18 comments no less than 3 different people are warning about doing something against the rules. It's weird. I don't know of any other subject that provokes responses about "the rules" like this. I could understand if the article title was "How to Aim Laser Pointers at Airplanes", but attach a long enough wire to an oscillator and people start to get uppity. On the other side of things, I don't know if you've turned on a shortwave radio recently, but the only thing I hear on mine is switch-mode power supply noise.
•
Hams take pride in being largely self-policing because this is one of the things that keeps the FCC interested in reserving sections of the spectrum for ham use. Also, I love hackaday for their articles but the comment section there is among the worst on the Internet. You'll find more enlightening discussions on the wall of a truckstop bathroom stall.
Like I said, "The medium is the message" One bad transmitter in your neighborhood can cut you off from the hobby. Someone who's into linux and computers can follow an online tutorial to rig together an SDR. Look at a bunch of numbers or static, shrug and move on to a different project without disconnecting that anttena breaking an entire band for all of his neighbors. Then it's on those neighbors to go build a directional antenna and buy portable radio gear and then do their own "in the field investigation" to isolate which house is doing that, then go try to explain to the random person they are polluting a band and hope the person is friendly and cooperative. In a perfect world the FCC would do that, but getting the FCC to act on small infractions like that is a slow and long process and often goes unanswered. Especially if you're not near a marina or a federal building or an airport. So one hackaday reader can take down ham operation in an entire area because they were just interested in a weekend DIY project. People throw that "against the law" to limit the damage. But actually getting the FCC to prosecute these issues is a challenge in itself.
•
I listened to a net on a VHF repeater once- some guy's PTT button got stuck, which ties up the repeater, plus you hear the background sounds from his house. It was quite funny- FCC not needed, instead somebody called him (you heard his phone ring and him saying "What?!" over the repeater).
I think it might be because ham radio is still barely legal and the community wants to keep the few freedoms they have so they try not to piss off any groups of interest. Whereas pretty much everything hacking-related is already a felony thanks to DMCA and other similar laws, so they don't have much to lose.
•
> Whereas pretty much everything hacking-related is already a felony thanks to DMCA and other similar laws, so they don't have much to lose. Hackers were much more rebellious in former days before such laws were past. My opinion the reason why hackers got more "civilized" is that you could earn quite a lot of money by getting (and staying in) a job in big tech.
In what country? I'm only familiar with rules in the US, and it isn't the case here.
•
I parsed that as: > HAMs are typically empowered [in their rule-following] by actual telecommunications agencies [who have] legislative authority to enter premises and what have you to resolve issues That is, hams (not "HAMs") feel empowered to advise others to obey the law, because they have to work with government agencies who can make life unpleasant for those who don't. It's not "hams [have] legislative authority". Maybe I'm wrong, but that's how I read it.
Why wouldn't a gunsmith buy stuff on eBay? We buy lots of stuff for our dairy/cheese plant business from eBay. When I worked in a mechanic shop there were always parts on the way from eBay too.
•
The amateur gunsmith scene in the UK is pretty small and if you're buying and selling parts and tools, you probably already know who you're buying from or selling to. It's easier just to speak to someone, bank transfer some money over, and they'll stick it in the post.
The FCC made up rules for marketplaces and now ebay is forced to follow it.
•
What statute gives authority to the FCC to "make up rules for marketplaces"? My understanding is that they only have authority over actual broadcasting.
RIP all those human person made wideband low noise amplifier boards that cost $5. Now I'll have to buy a $50 minicircuits or whatever alternative with an FCC ID. Despite the fact that I'd only use the LNA for receive, it still could generate and amplifies RF not in the ham bands. So they'll certainly be banned. :\ eBay simply does not have employees with the domain/technical knowledge to decide which things actually require an FCC ID to be displayed. As such they'll just ban anything and everything re: RF, like the example above. The FCC document from page 97 on has these tables full of extremely inaccurate ass-covering data pretending that >80% of all electronics sellers that might be effected by these new FCC rules are large firms (>1000 people) and that's simply not true. If they counted ebay sellers there'd be more human sellers than firms by far.
•
Are you sure LNAs will be an issue? Cause then they'd better ban transistors too, because they can actually be used as a power amplifier for transmitting!
> Im sure everybody will just behave in a vacuum of rules and wouldnt possibly do anything bad. It seems to work okay over here in the UK.
•
Ofcom is the UK equivalent of FCC. You've got regulations too.
•
Haha, no. *Maaaaybe* if you start keying up and talking over VHF channel 16, you'd get someone from Ofcom out. Someone buying a couple of cheap Baofengs and accidentally stepping all over the local shopping centre's security guard radios? Not a chance.
If I read this right, it's only banning stuff without an FCC ID stamped on it. If you want to list, you have to provide the FCC ID. I believe the FCC ban doesn't apply to used gear but seems like eBay is taking a harder stance.
•
Thanks, I read it as that regardless of the FCC ID _any_ transceiver capable of operating beyond specific ham slices of the spectrum will be banned. Thanks! (English is not my first language)
Anthropic Console overcharged my card 100x due to internationalization input bug
•
We are now turning HN into a support forum?
Hey @rsorto – sorry about this! I work at Anthropic and can see that there's a UI/form bug which didn't account for internationalization very well. A typed "5,04" got converted to $504. We're fixing the bug now and the support team will reach out to you directly to address your case, shortly.
•
Hola Jordan, Thank you very much for your support with this. I appreciate you stepping in, acknowledging the engineering flaw, and escalating my case. As additional feedback on the automated support pipeline: I understand the desire to automate and make processes more efficient. However, a person should not have to rely on getting a post to the top of Hacker News just to bypass AI bots and get a human to look at an obvious financial error. Luckily, you were here and acted proactively, which I truly value. I will await the support team's communication. Pura vida!
While you’re at it could you please also fix the bug where downgrading a team member from premium to standard, applies the downgrade to the wrong person at the next billing. I’ve reported this 3 months in a row and nobody seems to be hearing.
•
Passing that on to the right team! Thank you!
90% of US working hours are spent on tasks not covered well by AI benchmarks (mercor.com)
•
Glad to see more data and discussion of this. Lately the gap between ambient belief that "LLMs can now replace ~90% of all 'knowledge work'" and actual reality seems like it's growing. I've found discussions on HN tend to quickly get pulled toward polar extremes between those who are justifiably impressed at the increasing effectiveness of LLMs and those who highlight the brittle jaggedness and counter-intuitive gaps of LLM 'intelligence' in daily practice. One side keeps citing more examples of 'uniquely human traits' LLMs don't seem close to replicating while the other complains of eternally moving goalposts. Today I think both extremes are partly right but also partly wrong, and end up largely talking past each other because so much remains ill-defined, uncertain or currently unknowable. IMHO, the most accurate position is a carefully nuanced middle-ground built on well-defined scopes, terms, time frames and probabilities with frustratingly wide error bars. Partisans at either extreme seem uninterested in more than drive-by hot takes. It can be simultaneously true that "Someday AI will be able to functionally replace all human knowledge work" and "That day does not appear to be soon, and even when it arrives, there will still be uniquely human traits which are valuable and that LLMs can't satisfactorily replicate."
Yep, the "bullshit jobs" narrative sounds like an elegant description of corporate reality at the macro level, but always seems to fall apart whenever I've seen specific examples given which do in fact serve a useful purpose when interrogated. (Whether a role's cost/value tradeoff is actually worth it for a company is a different question than the idealized model of a "bullshit job" doing nothing useful)
•
> I've seen specific examples given which do in fact serve a useful purpose when interrogated. Interrogated to what extent? 'Bullshit jobs' was originally coined to mean jobs that do serve a useful purpose within the environment they exist in, but where zooming out reveals that the environment has no good reason to exist in the first place.
Curious how food service is at 0 tasks covered by AI. A few places have been switching to using those robots on wheels to run food to tables. And Doordash and Uber Eats have some robot and drone delivery in select markets now.
•
Restaurant quality is strongly associated with the quality of the wait staff. Grabbing food handed to you through a window at a drive through is already very highly automated. But also has the most price pressure.
> Is this not just a gimmick? You still need people on hand to take over if the robot has an issue, I don't see how it would reduce labour costs. "take over IF the robot has an issue" is exactly how it reduces labor costs. 2020: 10 waiters, waiting tables. You're on the hook for each of their salaries. 2030: 10 robots, one human waiter passively overseeing the cluster. You're on the hook for minor parts/occasional repair for the robots, and one person's salary. Its not about a 100% staff elimination, but a large overhead reduction ensuring the few humans you're keeping around are more efficient overall for dollars generated in revenue versus the all-human staff before. Plus, in certain cases, like kiosks replacing cashiers at fast food establishments, there's now one less qualification needed from employees (good social skills), increasing the pool of acceptable options you can hire where before some of those candidates would have been unsuitable for the job.
•
Wait staff already makes two bucks an hour in the US. It’s basically as cheap as cheap labor gets. It will take a while, and very cheap robotics, to make robot waiters worth it financially.
•
Okay so you go to a restaurant, who takes your order? The robot? Does it have a touchscreen like in mcdonalds were everyone has to spend 2 minutes awkwardly mashing the screen. Then the robot brings you the plates, then you have to put your own plates on the table, then how do you signal that you are ready to pay? Does every table have a button that you press to summon the robot again? Then you have to put your plates back on the robot? Who the fuck would go to a restaurant like this.
> Our findings suggest that 90% of American working hours are spent on tasks with little or no coverage from existing benchmarks. This makes it very hard to know how good AI models are at the work Americans actually do. > ... > But even after controlling for AI-exposure, O*NET tasks from occupations with larger wage bills are significantly overrepresented among benchmark prompts: So, in short: they want AI to take the good jobs. AI is not coming for jobs with tasks like "gather and empty trash" or "service, clean, or supply restrooms," or "mix water and detergents or acids in containers to prepare cleaning solutions according to specifications." We software engineers and lawyers would be smart to start retraining (and adjusting our living standards) now! And this points to one of the ways AI will help improve society and living standards for all: we'll have cleaner, better-maintained bathrooms, as labor one wasted on engaging intellectual tasks is redirected towards menial, low-pay tasks that still need a human touch. Reason to be optimistic, amirite?
•
> We software engineers and lawyers would be smart to start retraining (and adjusting our living standards) now! Instead most of us are "embracing" AI by training __it__ instead. Embrace, extend, ... and being extinguished.
•
Nope! :) Once mobile manipulator robots become good enough (and safe enough), AI will also take "gather and empty trash" or "service, clean, or supply restrooms" jobs as well. Large number of those bad jobs can be done with existing grippers or a simplified robot hand (without needing much more complicated human-like hand).
Automated harvesting machines for fruits is not an accomplishment of AI. Companies have been building machines to do that long before the advent of AI. Robotic manufacturing is nothing new. Back in 2012 I genuinely thought the self-driving car was going to put truck drivers out of work and reshape the economy on a timescale of less than a decade. This turned out to be a technofantasy. I think AI is going to play out the same way. AI is not a panacea for work, and the economic bubble forming around it is going to collapse with devastating consequences before we begin to see adoption of the underlying technologies for real ROI spread widely beyond the software industry.
•
I made the same mistake in my thinking wrt truck drivers. I've learned a lesson to be more skeptical about these things. So far I see that my own work as a programmer has changed radically, and it is far more productive. I still have a lot of work, but I really don't know how this will play out.
"Robotic" isn't new, human-level ability in manipulation is. The same goes for self-driving cars. It's a exponential, hockey-stick curve that at some point crosses the level of human ability. There is nothing "linear" about it and your suggestion of parallels to former experience is wildly misguided. People fail to notice, most jobs are less complicated than math and programming. The "obstacles" there are of the kind of "we always did it this way", but that's no real "moat"? The bubble regarding the big AI firms may well collapse, but the assumption, that was somehow improving the situation is far-fetched. People automated out of a job will either compete with those in other jobs or be dependent on support. Either way, salaries will fall across the board and prices rise. At an ever accelerating pace.
•
Prices can't rise while salaries fall in a functioning economy. Humans will continue to be cheaper for many physical applications. Your suggestions of the inevitable exponential curve for the improvement and application of these technologies is wildly misguided.
IDK do we still consider china - a country that currently has a fairly enormous middle class - to be communist? For that matter, do we view the current american economy to be a free market? (It's certainly "capitalist" in the strict academic sense of the word, wherein capital invested is the means by which ownership is ascertained, but that's generally not what people mean colloquially, so I find that using that term mostly bogs people down in semantics) Furthermore, why do you believe that the only possible outcome of class solidarity is violent revolution? Why do you believe that any revolution would inevitably settle on, presumably, a specifically soviet model of government and economic policy? I find that most american adults, even ones who otherwise seem intelligent, seem to have this picture of economic and power relations that just kind of sounds like a half-remembered bad cartoon of a cold war that ended before I was born.
•
Whatever China's regime is now, it is the expression of a population with a much more collectivist spirit than the West, a population that overall (i.e. a small dissident minority aside) is willing to submit to the Party in the name of social stability. The West is a lot more individualist, and a revolution under those circumstances is likely to be much messier. The point is that it probably wouldn't neatly land on a specific model, Soviet or not, but would first involve immense turmoil and infighting like revolutions usually do, and after that it still probably would never reach the effectiveness of China's post-Mao model.
Here is another view: maybe AI will automate jobs that are overpaid anyway and this might raise the baseline for the jobs that make everyday life actually possible. Of course only if the extra revenue doesn't flow into the pockets of billionaires, which is the more probable path
•
>"and this might raise the baseline for the jobs..." That's a bizarre non sequitur, pure wishful thinking. Its like saying Maybe getting cancer is good, because it will cure my arthritis.
> Responding to your edit, none of those things strike me as any more challenging than the control software. Do you have relevant experience in any of those fields?
•
Nope. I don't know what that proves. I couldn't have come up with a solution to Navier-Stokes either.
The problem is that your roadmap requires things that don't exist yet or only exist at prohibitive prices, and it's not knowable how much time or money you will need to solve either one. So a concrete roadmap is impossible. Advanced robotics would need to become quite cheap for them to become more affordable and convenient than a minimum-wage employee. And physical fields like materials engineering are known for moving quite slowly and at their own pace, so I'm not sure how much automation could help there. That's the last barrier we have right now that prevents the total obsolescence (and therefore destruction) of the common worker.
•
Our starting assumption was "Imagine I give you for free the perfect trash picking robot control AI software." If AI can deliver that, why can't it figure out how to take a Boston Dynamics dog, design it for trash picking, and optimize manufacturing costs?
•
Two different answers: 1. The discussion setup where you imagine a counterfactual is given by magic does not suggest that magic can do any other thing you choose. 2. Taking your question directly: because these are not closely related problems.
Again I don't think it's any less straightforward than "give you for free the perfect trash picking robot control AI software". The whole point is they can do better than us on these tasks.
•
“Give you for free” is a rhetorical device that focuses the discussion on the remainder that I didn’t give you. I didn’t make any claims about the relative difficultly.
Huh. When I click on the links the prices jump a lot.
•
That site doesn’t update very often. Try https//:pricepergig.com it updates in minutes not days.
I'm not sure you know what "stakeholder" means...? Either that, or you've had too many people use it to mean "people whose future is on the line based on the outcome of the product." That's one kind of stakeholder, but it's far from the average, and it's certainly not the most important kind. Anyone who has to work with the product is a stakeholder. Their stake in it is the fact that they will be interacting with it, and thus they care how, and whether, it works.
•
> you've had too many people use it to mean "people whose future is on the line based on the outcome of the product." This is pretty much the only way I've ever heard it used in the companies I've been at.
I sold all my SP500 yesterday morning (twitter.com)
•
I don't buy that AI is at saturation. From the usage the labs have internally its clear that when cost isn't a constraint they launch 10k agents. I don't see why other companies wouldn't want to do the same
I used to think the same but if the moon can affect tides, why can’t it affect humans.
•
I mean the mechanism there is not a mystery. Gravity is known to affect humans. Nevertheless, IMO the placebo effect is still an effect.
Hi, OP here. I sat with this for a bit, and I was going to ignore this, but my wife's honor is on the line, so I just can't. Frankly, whatever attempt at ad hominem here is uncalled for, and not befitting for HN. My wife built a product over two years ago and hit a massive need after over a year of crawling over broken glass. I had recently left my previous startup and was going to take a break. But she needed my help. There was one week where ChatGPT's custom GPTs had terrible uptime, so she asked me to built an actual web app. And that's how I was recruited. I was skeptical at first, given I don't believe in astrology, but I believe in the results. Not a week goes by that a user doesn't reach out to us to let us know that Star Path has had a massively positive impact on their life. Star Path has saved marriages, helped users gain the confidence to start the career they've always wanted, and more. I also studied applied math and economics at Yale (where I met my wife, actually!), and have been investing and building software for 20 years, as both a founder and engineer. Anyways, I'd love to keep the conversation and debate focused on the points I made, and not whatever preconceptions you might have re: astrology. Thanks.
•
If I am reading a blog post written by an MD about medical advice or whatever, then their next post is extolling the virtues of alchemy, it IS going to make me question everything else they have said, regardless of their professional credentials. Like, maybe you are able to encapsulate and separate the real from the pseudo-science, but it at least welcomes closer scrutiny.
•
I did not read the article yet but adhominem attacks is against what I thought this community stood for. It even saddens me more that you suffer this because you worked with your wife. Not all nerds are like this, take heart.
Because you are insulting her. You conveniently cut out the part of my bio where I explain she's the reason I'm working on this business. Now, your turn: how is the startup I'm building relevant to the conversation?
•
Note that I didn't mention your wife at all, nor did I pass any value judgement about your beliefs or profession. Any offence you took was due to your own insecurities, and getting hyper defensive about it isn't helping make your case. I do think it's very relevant to bring up someone's background, education, profession, beliefs and more when deciding whether to make a life-changing decision based on their advice. I'm sure there are >0 people who are thinking about selling their stock portfolios right now, and this post might be the one to tip them over. They deserve to know whether you are a financial analyst or an AI founder, and whether your own decision was made fully analytically or based on the position of the planets and stars.
JPEG XL vs. AVIF for web use-cases (jakearchibald.com)
•
https://jakearchibald.com/2026/jpeg-xl-vs-avif/#lossy---screenshot In full screen mode, the "hold for lossless" version "Firefox help"/"Submit feedback" are not underlined. In inline mode they are. Both modes seem to render a scaled down version of the image, which seems to cause these problems.
It's just a side project I'm working on with some friends. May release it if it's interesting to folks.
•
I would love to try it out.
But they won't be viewed at different sizes? But even then, the point is in making detection of artifacts easier
•
As someone putting an image on a web page, why would I make detection of artifacts easier? The images in the article max out at the maximum size I'd want them displayed.
OH WAIT. I KNOW WHAT'S HAPPENING HERE. You're looking at it in a browser that doesn't support JPEG XL, so it's falling back to a WASM renderer, and I think it handles resizing differently. This is totally my bad. I thought I was doing a good thing by adding that fallback renderer, but it isn't identical and it's giving people the wrong impression. The lossless version is JPEG XL, hence the difference to AVIF.
•
I also feel like sometimes the lossless image 'sticks' even after having released the button. Don't know how to reliably test that, though.
In Firefox 157.0.1, the right border of the image moves by a pixel or two when I press "hold for lossless" while viewing the AVIF. I think it's the lossy AVIF that's a bit too small.
•
That's what I'm talking about. JXL support landed in 158.
•
But why does missing JXL support make the AVIF too small? It ends one pixel before the gray background.
Most of the comparisons are not about what I would call "high quality" images. And the article supports what I have said. Quotation from the article: > But JPEG XL catches up at very high quality. Around SSIMULACRA2 85, libjxl's default matches AVIF's default, and at maximum efforts, jixel 'extraslow' is ~6% smaller than AVIF s0. jixel 'slow' is 10–13% smaller than AVIF's default from SSIMULACRA2 80 upwards.
•
'high quality' and 'very high quality' are different things.
It's not mandatory, and it would work without using it. The whole point is for forward compatibility support effect for sites which are very slow introducing these kind of changes.
•
It's not mandatory. But if you don't use it, the browser may select a source it cannot play.
•
Possibly, but as above, a much slower problem to solve is not in the browser support, but in sites support. Browsers in practice move way faster.
I don't get it. And to me it wasn't clear in the post. As others have explained the container and codec are two separate issues.
•
Concrete example. Let's say GitHub will add AVIF support at some point (it's not yet handled well by the site as you can notice[1]. You as user can then upload AVIF images to wherever images on the site are processed. And after that, let's say when newer codec inside AVIF will get a good browser coverage, you'll be able to start using it without waiting another decade for GitHub to pipe it through their site code. For formats without a container, it's always a two step process. Browser coverage first, then another huge period of sites support catching up. [1]: https://github.com/orgs/community/discussions/138164
Waymo in Toronto (waymo.com)
I would imagine Canadians aren't going to want an American company replacing their drivers atm...
•
Google employs thousands of people in Canada...
Oh there's going to be opinions, for sure. This is the high cost, zero returns portion though. They aren't trying to go live until 2028. In a way, it becomes a bargaining chip if they've spent all this money on mapping/testing Toronto and want to start operating in earnest. Though, ideally by 2028 we don't have to behave as low and as transactionally as the current American regime.
•
Some of the damage is permanent.
When I read these threads, I sometimes wonder if I was the only person to have a positive/unproblematic experience with Waymo
•
i had a funny first experience where the lidar got super lost on a bush, but it did a uie around the block and pulled in from the other side, and from there the experimence was that it was the best driver ive ever seen
•
I think the bigger lesson from what you say isn't so much about Waymo or this topic generally but to always remember that forums like HN are not reliable reporters of reality: they can only give you an indication of who was moved to say something and an indication of what they want you to believe... true or not. I'm sure you were already aware of that, but its easy to forget that and think you're dealing with something more real.
•
anecdotal but waymo was flawless. zenlike music. safe driving. Vs recent uber getting a lot of invasive personal questions from drivers, weird smells, only reason chose is it was half of waymos cost. Even at double the cost might just chose waymo next time.
•
People on forums will complain about everything! I learn this each time Apple releases a product. New iPhones could be $500, 10x the speed, half the weight and full week battery life and a fringe loud group will post and upvote some dumb complaint.
So we should start arresting engineers and executives?
•
Executives, definitely yes. One person should be responsible for automated systems and services. The CEO is the most logical choice.
Exactly, people on HN want new laws passed every time Cloudflare goes down for 5 minutes
•
To be fair, Cloudflare is near or at the point where they should be regulated as a utility.
I am not. They can alpha test elsewhere.
•
What metrics would you accept for you not to consider it an alpha test? Because they've been running in Phoenix, Az since April, 2017, and have been offering rides to the general public in San Francisco since June 2024. It doesn't handle Boston winters, it doesn't handle torrential rain, but it's a bit past "alpha" stage.
•
Alpha <- I should've put that in quotes, I suppose. My tolerance level is lower than yours, that's cool, but I am not getting into these things nor any robot drone choppers or planes. I can barely trust my HDA2 (ADAS) in my Ioniq 5 to not steer me into a rail guard.
•
They've been used in San Fran and LA and other large markets for years now. In what way are they still "alpha testing"?
•
Ok, v 0.85? Just the thought of testing these things on public roads, no matter when it happened, doesn't sit well with me in any way. I am not a Luddite, quite the opposite, there is just something off about the whole concept.
How is it you guys feel like the future is better when humans don't do things for themselves like driving? I get the idea that you no longer need a driver for a cab, but in my mind all that means is there's an unemployed former cab driver who is explicitly worse off now. The likelihood of that person having tons of great options to go do now that they aren't burdened by driving a cab is pretty low imo? There's probably a name for this somewhere, some kind of automation paradox that makes "society" better but many individuals lives worse. As an individual it's hard for me to understand why anyone is excited about it though
•
It's because women, late at night, intoxicated, don't need to get into the car of a strange man, and get assaulted.
If the number of jobs automated approaches 100%, then either what small proportion that is left is still sufficient to pay people, whether because the number of jobs in absolute terms is still large, say by the creation of new types of work, or because of reduction in working hours, or mass unemployment eventually forces some form of redistribution. Large scale automation is only a problem if society allows it to become a problem.
•
Unfortunately the gains of automation will not become our post scarcity utopia, instead they will be consumed by the new AI overhead and we remain in a regime of scarcity. AI will reshape all our processes and societies, that is where the gains will go.
> Large scale automation is only a problem if society allows it to become a problem. When I look around me I see a society that I think would happily have jackboots round up excess labor and execute us rather than redistribute money fairly So I wish I had your optimism
•
Well, I didn't say I'm confident that society won't allow it to become a problem. But I don't think a society that triggers mass unemployment and poverty at the same time will remain like that for long before it'd face uprisings. A society like that would also face the problem that without people having money they have no customers.
This is some crazy mental gymnastics. I’ve seen them around in London - they are incredibly slow. There’s no way they’ll succeed here - speed is important for getting around. This is what happens when people who live in a bubble automatically assume what works there must scale and make economic sense to the rest of the world.
•
There's no way their slowness is going to make a difference in London. I would have thought the real problem is that they'll just get completely stuck at places where you have to be a bit aggressive to make any progress at all. They don't really have that in America. That and cyclists/pedestrians can be kind of anywhere at any time. Again not a quite the same in America. We'll see I guess.
Last time I was in Vancouver I noticed more signs with translations in Sḵwx̱wú7mesh than French... However that might be because I am an anglophone from Ontario and my mind filters out the French language on signs if an English equivalent is present.
•
No, you were probably right. About the only French in Vancouver is in federal facilities: so, in practice, the airport and some parts of the port that nobody in the general public would ever go to.
The most complicated scenario, imho, is getting on and off a car ferry. Dark. Wet. Pedestrians. Dogs. No sidewalks. Flashing lights and lots of signs, most of which have nothing to do with car traffic. Lines on the road which you ignore in favor of following hand gestures. Then dramatic up/down ramps followed by parking way too close to other cars. And it is all in a metal box where GPS fails and internal systems are thrown off by ship movements.
•
There are very few reasons why a Waymo should get on a ferry. It can take you to the ferry and then you can get another transportation (maybe even a Waymo!) when you disembark.
RFC8950: Announce IPv4 with an IPv6 next-hop (anuragbhatia.com)
•
> R1 & R2 are IPv6 only with no IPv4 anywhere on their interfaces (but carry IPv4 routes in their table) … proceeds to traceroute with IPv4 addresses showing up for each router… It’s neat but still requires IPv4 to be configured on the router? What am I missing?
•
You still need at least one IPv4 address somewhere if you want to send ICMP back, yes. (Typically a loopback, i.e., something not connected to a specific interface. Routers use loopback interfaces for rather different purposes than a Linux workstation.) But you don't need to set up an IPv4 address on every interface, so you don't need a linknet plan. You can also forego the IPv4 addresses entirely, but then traceroute (and presumably also stuff like Path MTU Discovery; have consistent MTUs!) won't work. traceroute is often broken for entirely different reasons, though.
Ditch advertising public addresses to local devices at all. Have the router issue ULAs only and let the router do stateless NPT (network prefix translation) only. Done, works great. Doesn’t matter what your internet connection is doing. Yes, your local devices will use the ULA to attempt to connect to Internet destinations if that’s the only v6 address they have. It works fine.
•
> Have the router issue ULAs only and let the router do stateless NPT (network prefix translation) only. This is an option, but ULAs are ranked _below_ IPv4 in address selection preferences. So your network will essentially operate in IPv4 mode: https://www.ietf.org/archive/id/draft-buraglio-6man-rfc6724-update-03.html Moreover, some devices will refuse to connect to IPv6 GUA with ULA addresses altogether. > Yes, your local devices will use the ULA to attempt to connect to Internet destinations if that’s the only v6 address they have. It works fine. You're half right. The devices will work fine because they won't be using IPv6 at all. As I said, IPv6 is a recursive WTF. How do I know that? I made a personal goal to create a dualstack demo network that is fully standards compliant and supports the bare minimum functionality that I would expect from a SOHO network. So far, I keep finding new and exciting breakages on every level.
 Top