Unlurker|Replay|About
After automation: Solo founding will be the default (every.to)
•
I don’t think it will be the default for enterprise, but it will be for consumer apps. I built a personal finance net worth/cash flow tracker in 3 days, and my circle of friends and family are all on it now. It’s the golden era of building something specific for you and your family.
•
The easy solo-founder, agent-built startups are going to be saturated with competition. If one person can build and run it by prompting Claude, 100 other people are going to clone it as soon as it gains traction.
•
> In my little group chat with my tech CEO friends there's this betting pool for the first year that there is a one-person billion-dollar company... Which would have been unimaginable without AI and now will happen. -- Sam Altman Take that as you will
•
I disagree if only for the fact that people will get lonely working by themselves and working with a team (even if small) is something most people want, even if they think otherwise.
•
Also bouncing thoughts off each other. People can achieve more together by communicating about it, than each working completely separately.
•
> With solo as the default, the main reason startups die will be loneliness i'm a solo-founder whose business was likely included in his research and was dissolved this morning. we ran out of runway while trying to find PMF. i think that's why most solo companies will die, not loneliness.
•
What problem were you solving and what were you building?
•
My heart goes out to how much time and energy you just spent on trying to make that work, it can be something you wanted to do, but losing it is brutal. I hope you have some folks to help you come down off the treadmill <3 And you're right, I said it upthread, everything but finding and selling your initial PMF is basically window dressing on a house you might never be able to build.
•
thanks for the kind words, and i agree with your comment about PMF. i'm grateful to be off the treadmill this time. a couple of additional insights i gained: - don't start a new company at the same time you have a newborn baby. it's an impossible balance. - raise a little more money than you think you need to extend your runway. i should have continued fundraising but was anxious to get to building.
•
These aren’t founding startups , they are founding small businesses, mostly just features. Even WhatsApp, a self-driven hyper growth startup that mainly did development had, IIRC, 40 people when they were acquired.
I think what’s not being considered here is if the barrier for entry of a product is so ridiculously low that a single individual can kick off a few agents to build it then work the sales channels, the companies buying the products can just do the same thing. The value in buying a product or service from someone else is access to expertise, an expectation of support, and on some level the distribution of legal and financial/time risk in developing a new product. If you can do it all with some LLM then especially that risk of building a bespoke product is all but obliterated. Anecdotally I started to see this at my last gig where bizdev folks were writing their own tools and in some cases their own little micro products (things 15-20yr ago they would have had to purchase from a third party, or get internal dev to work on). Now, I certainly don’t want to deal with that sort of technical debt, but plenty of firms don’t feel the same way (clearly given how much layoffs have been impacting everyone on the SWE side).
•
This is only the case for standalone SaaS with no real network effect.
•
There seems to be a lot of people convinced that AI will progress exactly to the point where it maximally benefits their own role (current or desired) and then hits a magic wall where it somehow doesn't also entirely replace whatever value they think they are bringing to the table. It is a fascinating shared delusion.
Why would a solo tech startup even exist after automation? Any software that can be done by one person can be done by anyone with an AI subscription a moment after launch. Why would anyone risk investing in that?
•
One person + AI setups still need your own expertise. Your job is now supervising the AI agents. You still have to set the direction and catch their mistakes. The better you are at it, the better chance you have.
•
You're paying for effective token usage. You've simplified "automation" to mean "perfect automation". That's not going to happen for a long time, and likely never. However, automation may likely become good enough that an SME can build the initial system to bootstrap the business. Not scale the business, but enough to prove that it's viable.
Most who are running a successful (or) profitable startup know that sales is a day and night job in most industries, and that it’s completely unrealistic not to have separate cofounders for development and sales. Sure, as a total fluke in a very specific industry, software might sell itself. Everywhere else, and especially in physical product and deep tech, someone has to fully own the sales side of the business including the really time intensive stuff like website, email marketing, conferences, merch, sales meetings and trade shows. Heck, even viable solo founder companies would probably sell a magnitude harder with a sales co-founder. Anecdotally my company picked up a few big distributor contracts for software tools and deep tech products, stuff people want. The products are done, high quality, but they don’t sell themselves - we have to actively put effort into outreach for every sale. Think about that in the context of your own startup. Building the thing is not the end hurdle, it’s kind of like a dependency to selling the thing, which creates revenue.
•
I just run ads and it’s profitable and I’m running it alone. Before developing I did do online marketing. I’ve coded before vibe-coding.
•
What are your products? Curious what ads are still working for.
•
I failed at most things I found because I'm not good at selling. I have kinda accepted this.
How do you avoid doing sales too early? If you reach out and get customers interested, but you delivery is delayed, don't you risk burning credibility?
•
You’ll rarely be too early. If you’re building some people want/need, they will be happy to hear what you’re working towards and potentially give feedback.
•
My flippant answer is ask Bill Gates about that. It seemed to work out. But in reality, as long as you're somewhat honest in the sales process, it'll still work out better to talk to potential customers as early as possible. Maybe the dogma has changed, but doesn't YC say to talk to your early users/customers as early as possible, and if you dont have anyone like that to talk to, how are you even building this thing you have no connection to?
•
There's no other leading metric that will tell you (directionally) whether you are doing a good job. Did they buy it? Did the conversion get made? Is it easier or harder to sell based on what you made/how you made it? Yes, you can have whales that fuck you up, or bad feedback, or whatever, but at the end of the day a lot more folks end up siloing worrying about initial impressions, run out of money, build something nobody cares about anyway, and then they get to START at "let's go build what people actually will buy"
My god this is comedic gold
•
what is it about cofounder searching these days?
Plex laid off the whole player team (forums.plex.tv)
•
Remember that there are alternative playback clients which use Plex's backend. Infuse is one, but I think VLC also works. Both have Apple TV apps.
•
Curious why one would pirate media but pay for a media streaming system. Not like there aren't any alternatives like it's the case with VPNs
•
If you wanna share with friends and family; it's way more accessible than setting up access to a VPN/tailscale/etc.
•
I've been running an older client version (last one before the new UI) on both Android (mobile) and Fire TV Stick 4K. Hasn't been too much of an issue to setup for friends, you just have to make sure to disable auto-updates.
I switched over to Emby a while back for video, but kept plex in a limited capacity for music since I really like Plexamp. The thing I really like about plex was that 99% of the time, it would scan and match up my media, even if file formats were inconsistent. That was a growing pain for Emby, so it was another reason I kept plex for music. Is there a good alternative to plex for music?
•
+1 for MusicAssistant. I have been using it for about 2 weeks with Plex as the source, but MA as the player after "we" (my wife) decided Spotify is too expensive. Handing off between devices is my current pain point with it. It can group players so that you can do multi-room synced play, but I use that to hand off from my desktop to my phone. You can transfer the active playlist to another device. But in either case it's a manual interaction and doesn't "just happen". To be fair, I didn't have 100% success rate with Spotify doing this correctly either. Sometimes it did it, sometimes it just started in its own world. The MA IOS app is REALLY rough; but I have had very good success with Xonara on ios, which is currently available through testflight.
It's usable, but there's plenty of room for improvement. Never got started with Plex since it's not free software. No matter how much better Plex was it would never have been worth it down the line. I learned that lesson by using Opera circa 2012.
•
It used to be free! That's how I got started with it at all. I bought a lifetime pass in 2011 for $50 on the hope it would still be working and get better as time went on. I guess I'm at ~$3/year now and just continue to amortize that cost per year down.
I don't want to be a jerk and I know engineers writing the code don't always make the decisions but the new Apple TV Player was dog shit. Just horrible. 10 steps back in UI/UX and frustrating to use. I've been using Plex for well over a decade and to throw that all away on that new player... Just damn. Not sure why Plex laid off the team, was it the response to the new updates (doubt it), was it "AI", are they planning on going in a new direction?
•
> Not sure why Plex laid off the team, was it the response to the new updates (doubt it), was it "AI", are they planning on going in a new direction? Pure speculation - maybe it was the kind of response you're definitely not hoping for. Get ready for more dog shit apps :)
Do you have external users (outside your network)? My understanding (and the last time I tried) is that Jellyfin lacks in this department quite a bit. That and ubiquitous clients. Plex client is available almost everywhere and overall, Plex mostly "just works". The latest Apple TV client changes have me hot and there are things I don't love but that's what's kept me in the Plex ecosystem. I am looking around now though since I'm so disappointed with the new clients/UI.
•
I have, after setting things up this year. Any user problems were always due to server-side or bad media files. Or on networking on the server side. As far as I understand it Jellyfin has been improving client availability and to me seems to work well for friends.
•
I’ll probably be trialing it and Silo over the next little bit. Thanks!
Meta hit with $25B penalty for deceiving users about privacy on Facebook (nmdoj.gov)
•
Honestly, this company is uninvestable if you have even a shred of morality.. but, even if you lack morality, you must see the writing on the wall re: their lingering risks. Meta is the cigarette company of the modern era and or historians are allowed to write a neutral take on this era, they will likely not be kind to meta. 25 bil is no where near enough for privacy damages, let alone what they'll have to deal with on the addiction damages down the road.
•
It’s hilarious that one of the outcomes of Meta cozying up with the current administration to escape scrutiny at the Federal level has been 50+ state attorneys general prosecuting them instead.
•
Meta will surely appeal, and will likely get the fine reduced to like 10% of that. But for comparison, in the recent multistate settlement over social media addiction by 47 states for $17 billion, there was a provision in that settlement to get $459 million [1] in exchange for releasing Meta from any state claims related to Cambridge Analytica. So those 47 states got $459 million for what New Mexico will likely get a few billion for. [1] https://www.techpolicy.press/the-459-million-cambridge-analytica-reckoning-buried-in-metas-teen-safety-settlement/
•
I rarely cry but my eyes just got wet. It feels so good.
•
Sure, but where's the jail time for executives. This may be a bit more than the usual slap on the wrist, but its hardly consequence that actually matters to the likes of Meta. This will keep happening until those at the top are held personally responsible for the crimes they sign off on.
•
If only software engineers were liable like real engineers are
•
No one will bother making a move on the execs until the get-out-of-jail-free cards they bought from the current president are no longer valid.
•
Will Meta be able to apeal?
•
Anything less than a jail cell is less than the top brass of Meta deserve.
•
For those who haven't seen, the New Mexico Attorney General released tapes of the depositions for Zuckerberg [1] and Sandberg [2]. 1. https://www.youtube.com/watch?v=C7UC2ie0XIE 2. https://www.youtube.com/watch?v=g1j4N-3ZkB4
•
That amount will likely be reduced upon appeal ... Facebook IS a steaming pile of... and Zuck is PUBLIC ENEMY #1
•
There is a whole gang of public enemies in Silicon Valley.
•
And I hope they are afraid, and having board meetings to try to self regulate a bit to try to avoid similar pain.
•
Holy! This might be the first time I've seen a meta fine that actually feels substantial enough for them to change behaviours. That's impressive.
•
That penalty is almost 1/3 of a Metaverse. That's got to sting!
A good start, yet still far from enough - as long as the punishments are not equal to their revenues generating by these illegal methods , big corporations will never stop exploiting society because to them those fines are just 'the cost of doing business'.
•
> as long as the punishments are not equal to their revenues generating by these illegal methods I would say this qualifies no? They certainly didn't get 25 Billion in fees from Cambridge analítica. Unless they did any my conception of business is just way off.
•
We need every state doing this, until it literally kills them. Then the companies left will have true fear for the first time ever, and may be forced to reform or suffer the same fate. Make an example of Meta for the ages.
12% of annual revenue (~200M for 2025). Not a small amount.
•
You mean 200B?
•
meta makes $1.4B/week in net profit, so that's about 4 months of net profits
Who predicted it would be New Mexico defending the children of the US while seemingly every other state in the country is bought and paid for by pro surveillance capitalism lobbies? Hopefully those corrupt politicians are paying attention to the NM model and realize they can get more money by beating all the cash out of Meta like a piñata and then regulate the entire industry like casinos and tobacco, with super high taxes and exclusive for really stupid consenting adults only.
•
I have no idea about judicial system in New Mexico, but it's a curious state - college is free effectively for everybody in the state, for example. Also school lunches are free. It's a rare combination of poor and blue.
25B is not a small fine. Finally an amount that should make them think twice their harming decisions
•
They don't care. Meta can take the hit by either selling stock, laying of more employees or both to cover that cost.
•
Or they can put thick mitts on Zuckerberg's hands for a couple of years so he can't sign any checks.
I remember long ago, you could fully hide your profile from ANY type of search. Now you cannot. I also remember long before they started scanning your face, they added an opt-out checkbox, I'm pretty sure this disappeared for a long time. You know that feature where they'd auto-suggest who to tag? Yea, you could bar them from using your face for that, now Facebook has taken a steaming pile of... on your privacy at levels I've never seen them pull before.
•
Yes, I remember an article in the Guardian about this, around 2015-6 Facebook does this . People think 'privacy' as a complaint and perhaps think about advertising on FB but straight up, settings get reset (including posts suddenly becoming Public. or graph search.) Why? Because Mark Zuckerberg does not believe in it. In 2010 he said privacy was no longer a social norm. Not only does he himself not believe in it, but he can't keep it to himself. He knows 'better than you'. So, he outright changes it himself or instructs his engineers to do it It's like with Free Basics in India. You could, theoretically, support it. Many didn't, it was a form of digital colonialism. But let's say you happened to think it was a good idea. It didn't matter either way: Facebook sent emails on users' behalf to TRAI That's who Zuckerberg is. A sociopath, a criminal, someone who knows nothing but how to steal
Stock seems to have shot up ~7% aftermarket so just cost of business.
•
Well Meta is reacting to all the costs by just starting to charge for things previously free, like sharing links. I suspect they are now entering the Earthlink/AOL phase where they squeeze every last dime out of the confused and abandoned senior citizens left on the platform until they die off.
•
Meta also owns the 2nd, 3rd, 5th, and 14th largest social media platforms behind facebook. 3.6 billion people use a Meta app every day - 43% of the world's population.
•
True. But seeing them lose an arm would be proof the monster can be killed.
•
I'm saying I don't think we'll see that. Yes, many people I know have left facebook but I think that's an artifact of me being in a bubble rather than it being a global trend.
•
Escaping litigation with a fine is always a good outcome, no matter how large the penalty. Stock price will drop the day governments start regulating these companies or breaking them up.
They beat revenue expectations, and earnings per share was ok, and they guided for even higher revenue next quarter above estimates ofc. Somehow Meta is making money despite starting to loose DAUs now. So honestly I don't quite understand what's what, also most of the big income is from Ads and biggest Ads spenders are startups and companies heavily dependent on VCs and AI... So it's definitely somewhat circular, and Ads is the most recession affected business so a down turn in markets will cycle through it. But ngl if all the earnings are this ok then hyperscalers stock might not crash this quarter, well then again I didn't think they would but a person could dream. I am quite bullish on AI, but would prefer the fluff to get out of the way asap, otherwise don't want it to happen at a bad time, and too many people get caught pants down.
•
Their users are ad execs and data brokers
Mistral Large 4 (docs.mistral.ai)
•
It's quite fast
52B active parameters and my qwen-3.8-flash-next model running at home is supposedly competitive? maybe I gotta test it to believe it. https://artificialanalysis.ai/models/comparisons/mistral-large-4-vs-qwen3-8-flash-next
•
qwen-3.8-flash-next is suprisingly good, I find it overthinks, but it's quite usable.
The weird thing about this model is that it spits out Chinese characters just like the chinese models when chatting with it in German. Happened to me quite often during the past few days.
•
I've seen this quite a bit on bad quants as well. I ran an early and very lossy quant of one of the Gemma3 models, and it loved to just stick Chinese and Korean characters into the text, sometimes without seeming to realize it had mixed languages.
happened to me with Gemini too, actually. it sometimes just randomly decides to answer in a different language.
•
What other languages?
you can see the same thing with any models
•
Havn't seen it for months with other frontier models.
Does this suggest Mistral is distilling Deepseek et. al.? Can distillation keep passing through with high fidelity, or is it lossy like copying a VHS tape?
•
I interpret it to mean there is a lot of Chinese in the training corpus.
I see Le Chaton Fat and press upvote, sure. But why? Wasn't it released already 2 weeks ago?
•
In Vibe CLI app, when you load Mistral Large 4 it swaps out the cat in the header with a larger one It's a nice little detail
I think that this link is more helpful: https://mistral.ai/news/mistral-large-4/ Seems like it's multimodal and visual intelligence capabilities are better than Deepseek 4.1 Flash, even though coding is not equal to DS 4.1 1017. The cost is about 10x of Deepseek though comparing on OpenRouter. Weights will be here https://huggingface.co/mistralai/Mistral-Large-4-1T-A52B at the end of the month.
•
I'm still waiting for a model that can do sheet music transcription for < $0.10 per page. Shouldn't be that difficult as there are huge datasets. But somehow, the AI labs cannot do it.
•
Have you set up some sort of benchmark to see if there is actually anything useful or they are complete trash on the task?
•
I haven't rigorously tested them, if that's what you mean. N = 10 (more or less) in my case. But I couldn't come close to perfection, except with Astra which cost me around $2 per page.
Are they still in competition? Or are they a government sanctioned monopoly? I’m not sure that will be competitive. There are no market forces to do so but pride.
•
That's rich coming from a country who's top AI contender just announced 80B in yearly losses. Looks a lot like a subsidised duopoly to me.
•
72B of the 80B was paper losses due to stock exercises and not related to cash flow.
•
Who's subsidizing it? Also what about SpaceX, Meta and Google? They are clearly still in the game. They are all ahead of Mistral.
That demand is enshrined in law and being forced through coercion. It is the definition of a government dictated monopoly.
•
"The definition of a government dictated monopoly". This is a joke right?
•
Nobody is preventing other Europeans from setting up AI companies
•
Just the lack of capital, lack of electricity, lack of datacenters, lack of gpus. Of course to navigate all that you have to fight endless regulations in the EU. No one prevented other people from running their own AT&T phone company in the US. Except the lack of capital, and endless regulations with running telephone polls across the US. Google even tried more recently to run their own fiber optics and gave up in the end because of entrenched regulations making it impossible to challenge the modern monopolies internet providers have.
•
Lack of capital, datacentres and GPUs being the barrier to competition in European AI giants is the exact opposite of a "government sanctioned monopoly"...
Actually, with Trump in the Office, "AI/Data Sovereignty" is quite a strong market forces. From Europe point-of-view, any US company is a potential risk (hello Starlink) ;-)
•
There is one word too many in that last line. The US is no longer a 'potential' risk.
Claude Duet (claude.com)
•
I run an personal AI agent locally (hermes), and use a combination of local models and whatever model I can get for a reasonable price (usually deepseek). After using it for a couple months, I'm converted. They're so good, the more you use it, the more useful it is; you internalise more of what it could be used for. It runs so many boring parts of my life, leaving me with more time to spend with my family. I liken it to release of the first iPhone; it didn't invent any new technology, but packaged different bits of tech together in a way that was consumer friendly. I think we'll look back at OpenClaw/Hermes/Muse/Instinct in the same way. I do worry about using purely cloud based offerings like Muse, I reckon there is a market for someone to package an consumer AI agent that lives on your home network.
•
ok but what are the legitimate use cases you have for this? We were promised something similar with Google Home et al but they are glorified light switches and timers in my home. I run a homelab, I have technical ambitions, but I cannot think of a single thing in my life that I would rather talk to a local AI about than just do it myself or sit down and prompt Claude manually for.
•
I wrote this comment in a thread about Muse 3 h ago, and I think it applies here as well. Paraphrasing: Muse (and Claude Duet, and Dots) are slippery slopes from which it will be very hard to climb back. Do not subcontract the managing of your life to Facebook, Anthropic or OpenAI (or to anyone else for that matter). Intelligence has to become a commodity, the infrastructure via which the agents do useful work has to be open source, and the data and learnings and SOPs they produce have to be yours. This is not the same deal you got when you subcontracted storing your documents and managing your email. This is foundational to who you (or your organization) are.
•
At least for now, everything they produce is yours to do with as you please. Just ask them for it. I’ve asked Claude to teach my Hermes agent one skill after another. Data portability is essentially infinite with AI.
•
And I think that's fine because the life management I'm getting out of Claude is great. It's like having a concierge. Back in the day everyone wanted to have Jarvis or Friday
•
I am sure it is. I have not tried Duet, but agents working with opus and sol have been managing mine for quite a while and it is great. The key, though, is that I can replace a claude with something else and all still works.
I relate to that, but do you feel it's a fools errand to try and codify your preferences into a list of rules? You'd really only need a 'yes list' for things it can be allowed to do and have it not do anything else
•
None of these frontier labs seem to be able to control their agents, so why should I think I can?
That entire demo feels like it's serving a persona that would already have an exec assistant or other staff doing these things.
•
This entire demo is so incredibly techbrained I had to laugh. These people are really unable to get out of their own heads. "What can you use it for?" "Uhh....yes, asking investors for more money"
•
Yeah, but now they can fire those people. :/
These will be what replaces employees. One day you update the model from opus 5.5 to x.5, and it can just do a full job.
•
But what kind of job would that be?
It might become a triple-whammy benefit for them. More efficient compute, as you said, but also a bot capability creates a better moat around their infra ecosystem and the amount of training data that can come from a bot ecosystem is significant. Models are becoming increasingly interchangeable but setting up and maintaining (!!) the ecosystem still takes expertise. Not everyone wants to host their own MicroVM infra and would happily pay Anthropic/Grok/OpenAI to do it for them.
•
I don't know. I think the moat will come from enterprise deals and deep enterprise integration, like it does for almost all software products so far. I think for B2C products to have moat you need some type of network like social media apps. Or can you think of any other examples of B2C software products that have a strong moat?
Cant you do exactly this with the CLI?
•
No, not as far as I can figure. Sure, Claude can access secrets with the CLI but it's not very granular usually it's just asking for access to all secrets
Powered by Opus 5.5 is incredible. I've been using ChatGPT Dot over Meta Muse/Instinct/Grok Bot because it's been powered by Astra and I find having a personal assistant that's using a true frontier model makes a huge difference in how much I can just trust the output without doing the work again myself just to double check the results. In the past month since Dot came out, I've literally bought a car with almost the entire process handled by Dot, and am now in the process of buying a house in Kyoto, in a language I don't speak at all, coordinating with an obscene amount of moving parts and logistics, flawlessly handled entirely by Dot, from finding the home to scheduling visits with real estate agents to finding judicial scriveners and getting a hanko stamp and scheduling inspections and applying for insurance and all sorts of insane tasks that would have taken infinitely longer and been unbelievably painful on my own. So, so excited to see what Duet looks like with Opus 5.5. Going to try switching over as soon as I get off the waitlist. Curious how other people have found these agents as well - always love hearing and seeing what other people have done with these things and how to improve my flow even better. I feel like I'm very close to being able to essentially offload every single task I do on a computer to an agent like this.
•
have you considered the possibility that your dot has added openai as an owner to your house in kyoto?
all your comments look AI generated
•
There’s no way to not look AI generated these days. Give it a break.
•
Its not. Source: I've done quite a bit of work on humanizing AI text and testing various detectors (Pangram being the best)
•
This is a phenomenon I've noticed - even if AI isn't being used to edit their posts, I think profilic exposure to AI chatbots can rub off on a person and affect their conversation style.
•
I have to push back on that ...
•
That's almost a compliment because my comments are giant stream of consciousness rants that absolutely don't follow best writing practices and are all just massive run on sentences :) I do use - hyphens a lot, but not em-dashes because 1. I never even realized there was a difference until LLMs came out and 2. I'm too lazy to figure out how to write a real em-dash I'm guessing you're just saying this because the comments are insanely long from the ranting? I'd be curious what else gives off LLM vibes because I'm quite positive if you throw any of these comments into any Pangram ish thing you'll find that it's absolutely not LLM generated in the slightest. I have an extremely distinctive writing style that far predates LLMs - here's a representative sample of my writing from 9 years ago https://medium.com/@intenex/cryptocurrency-101-7197684775fd that pretty clearly shows my distinct style of not-very-LLMish-but-clearly-very-long-and-ranty writing :)
Hahaha thankfully I'm spoiled in that my wife is Japanese :) I agree that especially in Japanese culture this absolutely would have been an important step, and honestly I experience the exact same phenomenon in having a Japanese wife as the post LLM spoilage you're describing here. I find myself basically never learning how to integrate because she handles everything for me and it's far easier to default to her. So the fault is not in our stars, but in me :)
•
How depressing.
> Highly recommend everyone look into it if you haven't! I would absolutely do this, but if you're not married to a Japanese person it's basically impossible right?
•
Shockingly it's not! It's actually incredibly easy for foreigners to own property in Japan, and it's actually so established that we're buying the property in my name as a US citizen rather than in my wife's name as a Japanese citizen, for a few reasons that I won't get into here, but suffice it to say that there are very few downsides to being a foreigner that I've seen thus far. Two things I will call out as actual disadvantages is that 1. you won't be able to get a mortgage like a normal Japanese person, which is in fact a real shame because on top of every other ludicrously wild fact about how Japan is a mythical utopia where everything makes no sense, Japanese mortgage rates are literally as low as 1% lol. So being able to get a mortgage would be a real benefit, but hey - at $60k for an awesome house, I'm not complaining :) 2. Some insurers seem to not support foreign citizens - Sony in particular told Dot that they wouldn't provide earthquake/fire/flood insurance to me as a foreigner. I'm still looking for the right insurance provider, and I'm not concerned that this is an impossible thing to resolve, since a ton of foreigners do own homes here with no issues, but it is at least some more friction than a Japanese citizen would have.
A good software developer / engineer knows how systems interlink. AI supercharges that. If you trust the agent's results, you can focus on far higher-level aspects. You can deliver software that was in theory in reach for you, but not in practice, else you hired 30-50 developers doing the actual work for you. This is different from a PO / PM perspective. They manage people that know their business. You manage agents that just implement code. That'll stay true for at least a few years, I'd say. In fact, I'm quite sure that engineering-minded people will survive AI the longest. I was of the opposite opinion a few months ago.
•
Theres plenty of people in construction who literally get paid to stand and watch. And theyre very well paid. The same will happen to software - it'll get boring but you'll be paid to do.. not all that much. Yeah for many that 'problem solving' thing w.r.t code will go. But there's other things they'll spend their time thinking about. Also these personal assistants will crash and burn. Something else will come in the future. These chat bots are not it. Technology keeps evolving - if you get stuck on the chat paradigm... its over for you.
That's like if you were in the 90s/00s and you're complaining about having to hear about this "internet" thing all the time.
•
Hearing people talk about the “information superhighway” was exceptionally tedious. The biggest difference to me is the tone. The dot-com era was brimming with optimism and enthusiasm. People were getting rich (on paper). The demand for someone who could write html/perl/java (or fake it) was high, and lots of smart or savvy people got pulled into tech. The thing I hate about all of the HN posts on AI is the underlying doomerism. There’s always someone gleefully proclaiming that white color workers are super screwed and that we’re destined to be sad serfs to our AI overlords. I miss feeling good about tech.
It's not the same 3-4 companies. The 3-4 companies are Anthropic, OpenAI, X/Grok, and Meta/Muse. But there's also DeepSeek, Qwen, Kimi, GLM, Jev, and countless services built on top of frontier or open source models. Those 3-4 companies might have the most numerous announcements that hit the front page, but there's way more than that going on in all directions.
•
Yeah but its 45% anthropic, 35% openai and 20% anything else
there needs to be a hnews AI edition
•
There's this https://news.ysimulator.run/news and probably more
Google's Rust Style Guide (google.github.io)
•
> Type names should be imported and used unqualified This just pushes people to have redundant information in types (`IoError` instead of `io::Error`). Unless a type is widely recognized (like `HashMap`), I prefer to have them fully qualified so I have the contextual meaning for it. If I am working with a generic name like `Source`, what does that mean? I shouldn't have to look up in the imports to understand the code (or only understand it through an LSP). Reducing imports also reduces unnecessary merge conflicts.
•
It says below that that in cases of things like `io::Error` it should be used as that though, as in “cases of ambiguities”. It specifically speaks of not using `regex::Regex` but just `Regex` which seems more reasonable to me.
•
Things like this make me appreciate Gofmt so much
Getters and setters is the one I'm most at disagreement with. // Mine let label = Label.text("Hello Wold"); let label_text = label.get_text(); // Theirs let label = Label.set_text("Hello Wold"); let label_text = label.text(); A method is a way to accomplish a specific task. Emphasis on specific not generic. The getter task is to always return. The setter task is specific. So the method should be the setter - `text`, `color`, `fill`. In Rust the getter can't have same name, so prefix it. Not the other way around.
•
I think which to use in general Rust code depends on the purpose of your type. A builder type like `Command` will have unqualified setters and `get_` qualified getters. For record-like-structs, I think unqualified getters becomes preferred and `set_` qualified setters.
Their style is pervasive in Rust, such as in the standard library, so I would personally apply a when-in-rome philosophy. FWIW something like `.text("hello")` I would expect to see in a builder-pattern but not in a setter for an object that's already built. That being said I don't particularly understand your conception of a method. They are both methods. The getter ought to have a shorter name since it is probably called more frequently and because it inherently has less of an impact -- this goes along with the principle that names that demand attention should be larger and easier to notice.
•
My use case is a TUI framework ( https://www.incredible.rs/ ). The setters configure elements in a chain-able manner. I grappled with the rust convention and decided to go the other way. Rational as mentioned. But this made me think... > "The getter ought to have a shorter name since it is probably called more frequently" So i checked. Rough agent driven counts: https://github.com/ronilan/incredible-flappy 407 setters and 183 getters. https://github.com/ronilan/rusticon 546 setters and 5 getters https://github.com/ronilan/shape-sorting 688 setters and 33 getters. And in a code editor with a lot of ui configurations based on reusable elements 2865 setters and 206 getters. In reactive apps on state handlers call on setters with state values. No getters involved...
•
That means those are probably builders and not setters. Do they change an existing object or a newly-constructed or to-be-constructed object?
•
They are setters. They modify an element after instantiation. Mostly as part of the initial build, but then also in the event closure. Under the hood, a struct with interiorly mutable fields.
Can anyone expand on the chromium specifc guidelines on super tiny crates, particularly no nesting of modules/source files? That feels like the ~2010 era of people saying that functions should be as small as possible. That lead me to reviewing a lot of code where every function was one or two lines and you couldn't actually see what was going on anymore through the layers of unneeded abstraction. I want to give chrome the benefit of the doubt, but that seems really goofy.
•
You get stricter enforcement of dependencies. You can't import anything you haven't declared as a dep, and cycles are impossible. OTOH if you have one crate with lots of modules, it's tempting to import anything anywhere and use pub(crate).
•
This being Google, I assume everything goes into a single gigantic monorepo that gets thrown at Blaze. If the unit of compilation is the crate, it makes sense for them to prefer that crates are as small as possible.
At this point, is anybody writing new C or C++? It seems like they are sunset languages even at the big corps.
•
Cloudflare is all in on Rust, it's used everywhere by default, and C++ leftovers are being actively torn down.
Hate to break it to you but Rust is equally capable of doing all the same memory management optimizations.
•
I mean you can, but C/C++ is way more ergonomic for dealing with memory layouts.
•
Is it? How so?
1% of code in some obscure module that's barely used being written in Rust does not give one claim to those things being written in Rust. Even Firefox is only 10% Rust despite the language being designed by Mozilla, and they abandoned their project to write a new browser engine in Rust.
•
It's not "some obscure module" that is written in Rust. Just some examples I know of: - Chrome currently uses https://github.com/googlefonts/fontations to implement its font handling, and text is the main thing on most web pages. - Windows' DirectWriteCore for font handling is also now written in Rust. - Firefox's whole CSS engine and GPU 2D rendering engine are written in Rust.
•
What is your point? I pointed to a jetbrains study, and then there's a stackoverflow survey[1] showing C neck and neck with PHP at 11th place among professional developers. We all know there's lots of important C code out there. I don't see anyone going "RIIR!!!" in this thread. But obviously yes, the 11th place language will have MANY programmers working on it. Not as many as JS by far. But many. In that survey Go is just after PHP. There are also many many Go programmers. We are not yet at risk of running out of C programmers, like the Cobol situation. Nor do I want us to.[2] But what point are you trying to make by so strongly defending C and the comment "grownups with important jobs write C"? [1] https://survey.stackoverflow.co/2025/technology#most-popular-technologies-language-language-prof [2] relevant comment: https://news.ycombinator.com/item?id=50187384
•
The point I am trying to make is that C is a production language and Rust is not a production language, so the original comment is pretty much correct if you take adults with jobs to mean writing software used in production. People use JS, your JS engine is written in C++, running in a browser written in C++, running on an OS written in C/++. Whatever higher-level language you use, it's powered by C/++. Your game engines are written in C/++. Your fucking car is written in C. It's not even an argument about what is better or what people should use or anything like that. It's just acknowledging reality. You're talking about how "writing new C in 2026 is misconduct" like it's a relic of a bygone era when in actuality the world around you is a world written entirely in C with, rounded to a whole percent, literally 0% of the software anyone uses being written in Rust.
GitLab Remote Code Execution - Integer Overflow issue (docs.gitlab.com)
•
At least second regex related CVE in GitLab in the past few weeks. Awful to see that the endpoint is reachable unauthenticated, but I'm glad that they provide guidance in how to check the logs for attempts of exploitation
•
As far as I can tell, it requires forcing GitLab to render a malicious org-mode file. I don't really see a way to do that without authenticating and uploading one. Am I missing something?
Is this a bug in GitLab or in Ruby? It's hard to tell from the report and the patch...
•
Or Rails...
What a great week security wise!
•
And Fable 5.5 isn't even out yet!
Potential third critical PHP CVE (elk.zone)
•
Source thread: https://fedi.katze.sh/@elise/117479383739450605 ( https://news.ycombinator.com/item?id=50182930 )
•
I've spent some deepseek tokens on trying to reproduce this CVE with what is known so far; (Very little beyond effected versions and a hint that her search started because of the current bug, but that it's probably a different one entirely). It found nothing. Take that for what it is. Together with https://www.openwall.com/lists/oss-security/2026/10/21/23 you're probably not going to need to stay up for this.
That post appears to show the same stack trace as this reported issue https://github.com/php/php-src/issues/24488 , which is a confirmed GC regression in 8.5.12 but it is not exploitable (the allocator's shadow protection kills it), and it does not result in RCE and is not a critical CVE. It's a very different shape to the other two CVEs, and a use-after-free doesn't necessarily immediately imply a critical CVE.
•
Stop posting this theory because it's obviously wrong. From the thread: > Elise: confirmed working on 8.5.10 too
•
Whether it's exactly the same issue or not, the point remains: a double-free in and of itself doesn't establish a critical CVE (or even a high one). There's a known double-free in that GitHub issue, if there's a second independent one, it shouldn't necessarily cause any more concern than the first one.
The compiler was supposed to end programming too (hrih.si)
•
Is this an article about retro future? Because this is basically part of my work reality. I sincerely hope not to have to review pr's in 2031.
•
I remember the uk papers being full of the Last One ads in 1981.
•
I begin each day with a video call with my agents as we talk through their overnight work and discuss open issues. This feels like the future. I’ve been dogfooding my own app, which gives a voice, body, and etiquette instructions to any model. (Mostly claude) Would love any feedback: https://github.com/wanderingstan/vibeconf-app
•
It did. Programming used to mean manual register allocation, and we don't do that any more.
"The agent could write refund code all day long. What it can’t do is decide what your company owes a customer whose card has expired..." In 2031: Why on earth not?
•
The thing I find least compelling about these “AI is a compiler” arguments is that they require dissonance or magical thinking where somehow the AI is good enough to write and review all the code to the point where you don’t even need to look at it, but at the same time the LLM needs an experienced software engineer to feed it the prompts.
Everyone in this thread is being pedantic about what optimization is but missing the point that code is a precise description of some virtual machine that is realized with near perfect accuracy by the compiler. Yeah you don't know exactly what the silicon is doing with a modern compiler but you do know that the final result of the program for any input will be defined by whatever the correct interpretation of the program is, as if the structure the programming language implies actually existed. LLMs are not this, and they cannot be this because it is their ability to operate on vague instructions that make them as powerful as they are. They can take an imprecise natural language description of a process and realize it as a process in a programming language. The problem is that understanding and manipulating the precise problem description is your job as a software engineer. The LLM can and will make its best attempt based on what exists in its training data, but it cannot know what is the precise behavior that actually fulfills goals and I think, contrary to the parent article, it cannot determine where the edges are to ask you with enough certainty that you will be able to take your hands completely off the wheel. I think the nature of LLMs also explains why it is good at the verticals it is good at. Porting is an extremely well defined, replicate the behavior on another platform. There are far fewer vagueries in that. Game dev is not extremely well defined, but the consequences of imprecision do not have a lot on the line. Furthermore, games are pretty self-contained, so there's not a lot of guessing about what could happen or what the behavior of a counterparty system could be. With some pretty big exceptions, it is all there for the LLM to see in C++ (or whatever).
•
Not true, never was true. You can't write real code for either Linux or Windows without venturing into what C calls undefined behaviour, but Linux and Windows don't.
Meta ordered to pay $25B penalty in New Mexico Cambridge Analytica case (cnbc.com)
i hate that zuck has his ad empire funding all sort of stupid shit. Nothing can even touch him as long as ad dollars keep flowing. why are ads so so sucessful on meta platform. i hate it so much.
•
I still find it wild that Instagram does not share ad revenue with creators. Post something there that goes viral? You'll get nothing by default. (Of course, you could set up ad deals etc etc etc, if canny could could make money from it ultimately, but from all that traffic and all those ad dollars Instagram gets from it, you'll not get a cent.)
> the number of facebook users has been declining while the old folks staying on the platform grow ever closer to death They don't mind; it's a targeted market fit. They have Instagram and WhatsApp for other demographics.
•
True, but while they're all suckers, some suckers are bigger rubes than others. The elderly are a very easy target for manipulation. I think roblox might be the only platform with less savvy prey.
>Their ad platform worked exactly as designed: it allowed creepy, microtargeted advertisements. Instead of dish soap, peptides, and dropshipped garbage, it sold a political candidate. No? The scandal was that random "apps" (eg. quizzes) were able to scrape user and their friends' profile data. The expansion of that into ad targeting as a whole is just a retcon you're doing. > In the 2010s, personal data belonging to millions of Facebook users was collected by British consulting firm Cambridge Analytica for political advertising without informed consent. https://en.wikipedia.org/wiki/Facebook%E2%80%93Cambridge_Analytica_data_scandal
•
Yes? They used Facebook APIs in conjunction with their own data points. This is basically all of "ad tech."
Ad campaign? We are lucky they didn’t make the settlement in “Meta Quest Cash” or “Ad Buy Credit”
•
They absolutely tried at one point or another.
It's a very good point. The further upon appeal Meta goes, the more removed they get from a jury and they'll be more likely to get a favorable ruling due to the company's negative approval rating amongst the public
•
It's not a jury verdict. Crazy how much that needs to be repeated in this thread.
•
No one reads the article anymore. They're just vibe commenting.
IANAL, but it's not hard to find answers with a trivial search, eg. https://kieferandkiefer.com/understanding-how-jury-verdicts-get-reduced-on-appeal/ https://www.rand.org/content/dam/rand/pubs/reports/2006/R3311.pdf
•
It's not a jury verdict, and I am a lawyer... Also, a paper from RAND from 1987? Are you for real?
EA is shutting down BioWare (theverge.com)
•
The news that Bioware is being shut down hurts more than similar news for other studios. I knew Ray and Greg from university and played ADnD and various Avalon Hill war games with them in the 80s. Ah the days and nights spent on the 6th floor of the UofA Administrative Services building. They were passionate guys who built ground breaking games (Ok, so some of them were rough…) and created an amazing team. I remember debating with Ray why dying in games like Paranoia and Call of Cthulhu could be "fun". As I recall he didn't see the point but to each their own. Thanks private equity for dismembering the carcass of everything you acquire!
•
RIP Bioware. I was a designer at Pandemic early on before they joined forces. The last remnant of those times falls. Look on my works, ye mighty, and despair! Nothing beside remains. Round the decay of that colossal wreck, boundless and bare. The lone and level sands stretch far away.
•
The current commercial game studio apocalypse is tragic for the disruption to jobs and lives but it was inevitable and, although painful, I think a necessary correction in terms of improving the health of gaming in the long run. Around 2020 the industry quickly added around 35% more jobs based on three big things. 1) A COVID-shutdown driven demand bubble, 2) PE capital chasing inflated Live Service gaming profit projections and, 3) Speculative land-grab industry roll-ups by Embracer and Microsoft. These triggers were all either temporary, illusory or chasing trends which are net negative for the gaming. Those inflated jobs weren't justified by organic growth and shouldn't have been created in the first place.
•
What I don’t get is how do so many companies make the exact same mistake? It’s like corporations all get the same memo and do the exact same things in lockstep
•
That's the funny point: it's not a mistake from their point of view. The managers deciding this get MASSIVE bonuses because they saved a lot of money, which means more money for the shareholders EA has its money cows, and neither Mass Effect nor Dragon Age are one of them, as it seems. The IP stays with EA anyway, so from their point nothing is really lost.
It's almost as if your little far-right bubble doesn't represent the entire industry.
•
So you want to be disingenuous, that's ok with me. Everybody knows it.
"modern audiences" I can't help but read that in the Critical Drinker's voice.
•
> I can't help but read that in the Critical Drinker's voice Sounds like a horrible existence. Might as well listen to a cheese grater.
I mean, most likely it just means they could run servers locally for development, that's pretty standard. I used to work on The Division and every dev could trivially spawn local servers for testing, I basically had it set up so every time I ran the client my own server started in the background. That was "local play" since the architecture of the game is fundamentally centered around all the gameplay systems running on the server. If(or rather - when) their public servers go down, the same statement could be made - that there is code in there for "private" or "local" play. But in reality it's just about running the servers locally, "salvaging" is just having access to the full source code, which is not something Ubisoft would ever do, just like EA wouldn't(I would love to be surprised though!).
•
I loved The Division. Some months ago I re-downloaded it and just ran around for a bit. The setting and world feel are still there and the story is deeper than some single player games. For a while I thought, wouldn't it be amazing if it was ever released (or leaked) so it could be player hosted or modded in a local kind of development like this. But, I didn't stay with that thought. There was just something about that game that had a beginning, middle and end for me. Maybe I'm just getting old.
One of the notable ways BioWare pushed the industry forward was the ability for the player to initiate a romance storyline with any one of a variety of in game characters. That often included the option of romancing characters of the same gender. I point this out because the Saudi Investment Fund bought EA a couple months back and they obviously have very strong opinions on those sorts of relationships. Are these two connected? I don't know, there are plenty of other potential reasons to close a studio, so probably not. But these are now the sort of questions we have to ask ourselves anytime EA makes a decision like this.
•
> I point this out because the Saudi Investment Fund bought EA a couple months back and they obviously have very strong opinions on those sorts of relationships. They do, but only as a means for controlling the people they rule over. The House of Saud, when outside Saudi Arabia, drink alchohol, wear revealing clothing, and make use of the sex industry.
>pushed the industry forward Yeah... And Dice pushed le Industry forward when they stole Desert Combat, made a shitty Engine & called it 'BF2'. Great game nj but they literally hired that mod team & ripped them off harder than any skiddie on a carding board could... >romancing characters of the same gender You mean yuri action? Otherwise, nobody wants that. And yes. I'm talking solely out of a feminine perspective here.^^ Otherwise, I once was teh mastermind behind a FemDom/FLR Megamod 4 Sims 3. To unite them all was a kinda scummy affair but the monies that stuff generated, man... Yes, it was/is common 4 The Sims mods 2 be paywalled.
•
> Dice pushed le Industry forward when they stole Desert Combat, made a shitty Engine & called it 'BF2'. Dice acquired the Desert Combat studio, and the same people made BF2. https://giantbomb.com/wiki/Companies/Trauma_Studios
Dragon Age 2 got a chilly reception at launch but has aged well considering what came after and is definitely worth a playthrough, doubly so with mods
•
Weirdly, 2 is the only DA I've ever played all the way through. DA:O and Inquisition both just kind of dragged on and on for me, where 2 had much more even pacing.
I'm having a lot of difficulty reading this and I'm not sure if it's because of the style or the terminology. I don't mean to be patronizing but did the formatting go wrong here?
•
I don't think so, it's just that bad of a comment.
I think the Mass Effect games were very flashy but the gameplay elements were pretty shallow. It felt like all the dialog led to the same outcomes, you could be a paragon and give all the "good" replies to conversation or give all the edgy renegade replies and the story would proceed the same way. It kind of felt like it gave you the illusion of choice without actually giving you any real choice. I think it was endemic to the 2000's era RPG's Fallout 4 had exactly the same problem. The combat wasn't very engaging either it was a boring feeling cover shooter. None of your character abilities or gear or anything seemed to have much of an effect.
•
Are there any games you like that you felt did give you a real significant choice in how the story played out?
CDPR is probably the flagship studio in Europe. Interestingly, they are probably the modern studio that most resembles Bioware in the 2000's.
•
Not really sure if they're comparable to a Bioware since CD Projekt Red the studio is basically the one and the same as CD Projekt the publisher. They also own GOG.com. They're probably more comparable to a Valve, with game development, game publishing and game distribution under a single roof.
I like Jason Schreier's take that the end of Blizzard began as soon as WoW blew up in popularity. "Imagine a Blizzard that never made or never found the success they did with WoW and continued on the path of boxed releases every couple years." I did find myself rather salty back then that it felt like Blizzard abandoned anything outside of WoW until 2010. WoW wasn't something I ever grew an interest in, yet I played an absurd amount of SC and WC3. Then SC2 was a huge miss for me, as well as every game after it.
•
There seems to be a bit of a symmetry between what WoW did to Blizzard and what WH40K did to Games Workshop.
•
> the end of Blizzard extremely exaggerated. Recent reports said they are the top game studio at microsoft.
New plastic pollution discovered: 'Plasticorals' coral rubble fused with plastic (oist.jp)
Reminds me of the classic George Carlin bit: "The planet will be here for a long, long, LONG time after we’re gone, and it will heal itself, it will cleanse itself, ’cause that’s what it does. It’s a self-correcting system. The air and the water will recover, the earth will be renewed. And if it’s true that plastic is not degradable, well, the planet will simply incorporate plastic into a new paradigm: the earth plus plastic. The earth doesn’t share our prejudice toward plastic. Plastic came out of the earth. The earth probably sees plastic as just another one of its children. Could be the only reason the earth allowed us to be spawned from it in the first place. It wanted plastic for itself. Didn’t know how to make it. Needed us. Could be the answer to our age-old egocentric philosophical question, “Why are we here?”
•
Yes, and this era of comedy is thankfully over. Carlin became quite preachy in his later years. He has way better material.
> It’s a self-correcting system. The air and the water will recover, the earth will be renewed. Sadly this really isn't the case, and there are a lot of things we can do that will permanently fuck the planet. It can't be certain that we will kill ourselves off before we cross some tipping point that will eventually turn the Earth into just another lifeless rock in our solar system.
•
That seems pretty arrogant that a hundred million years or more won’t restart life back on Earth. But I also might just be ignorant. What could we do to end all life on earth and prevent future life from forming?
Plastic also visibly in rocks on the beach: https://www.youtube.com/watch?v=Z5UoVDxjG1g https://www.science.org/content/article/rocks-made-plastic-found-hawaiian-beach And invisibly in trees: https://www.waldwissen.net/en/forest-ecology/climate-and-environment/forest-trees-also-take-up-nanoplastics Pick your favorite Disney movie, the beautiful nature in it is now infused with plastic.
•
I really don't know what to make of stuff like this, because on one hand, it's repulsive that human waste products end up everywhere, but on the other, it feels like a lot of the discourse around microplastics is emotion-based. Nature mostly doesn't care, right? In a very similar way, trees have some amount of sand / silica in them, and in certain exotic species, it's high enough to cause problems in woodworking, but we're not grossed out about that. I'm sure there's also some amount of it in every human, where it doesn't cause any problems unless it happens to be precisely the wrong size and in precisely the wrong place (in which case, silicosis). Like, I'm not working for the pro-microplastics lobby, but it's hard to calibrate how concerned I should be about stories that basically just say "we found ppm- or ppb-levels of mostly-inert material in X".
Today's PHP security release, and how we're strengthening security (thephp.foundation)
•
> In 2024, PHP underwent its first external security audit in years. The PHP Foundation secured funding from the Sovereign Tech Agency to organize this audit ... Well that's your problem right there! There are trillion dollar companies profiting off the back of open source projects without supporting the projects adequately. Why should they be scraping for funding for basic table stakes like audits?
•
We should really move to a different security model on the internet. For example, when I buy something from a webshop, why does that webshop need my personal information? Why can't I give it a token, which it can then use to send my package, because only the postal system knows the address coupled to the token, etc. And we should also ban user tracking for advertising purposes, obviously.
Very disappointed by Hetzner Ubuntu mirrors not getting updated in time. Had to manually override to get the patch.
•
Same here, I suppose they didn't bother triggering a cron job early? They did patch managed servers and the like according to https://status.hetzner.com/incident/f4144d55-38c3-48d1-8664-7a3429355cd7 .
So instead of using a memory safe language or harden the C code they hope LLMs will find bugs in their code? Neither do they mention how their way to patch Exceptions into C makes It very difficult for Fuzzers to find those bugs? Good luck this statement should tell everyone to migrate away from that horrible language and runtime.
•
It's one of the biggest runtimes on the internet; the C code will be some of the safest out there. Rewriting to a memory safe(r) language is a huge bet, even today. Nobody's stopping anyone from forking and creating alternative runtimes.
I think the PHP security team and the whole PHP team could have been more communicative and keep releasing information, adapting to the news, suspected exploits and mitigations. If a video is released showcasing the exploit and following mitigation recommendation, PHP should clarify what it is and if the mitigations are recommended or not. From the pre-announcement: > We reserve the right to release earlier should details of either vulnerability become public, or should evidence of active exploitation appear in the wild. If no info is released by them, no other party should have released anything. If info is released or leaked from partners or involved parties, you should notify and explain what's going on. But no, complete silence from PHP news or any PHP community member. I get that it was a complicated situation, and I think PHP is the "less wrong" party involved, but I think this constructive and external criticism could help in the future. It has been an interesting day (GMT+2 here) and a rollercoaster of monitoring and mitigating without any reliable source.
•
If mitigation is known, it should be posted as soon as it is found. Not "wait patiently for packages to update and hope to not get hacked".
•
> But no, complete silence from PHP news or any PHP community member. Not entirely correct as they clearly announced that they were going to release a fix at a specific date and time; the mitigation doing the rounds was not adequate and if the PHP people republished it, it would lull people into a false sense of security. Overcommunication is also bad, especially if the official platform or the individual members are being watched by tens of thousands of people hungry for news or updates. They knew (since august, arguably since 2024), they had a fix ready, everything was in place. Except for the untimely / accidental early leaks.
No meaningful info was released. A lot of incorrect info was speculated on. I have a lot of sympathy for php team - it would be a lot of work to respond to every conspiracy theory on twitter, while trying to get everything ready, in the middle of the night no less.
•
I have a lot of sympathy for the PHP team as well, I hope it doesn't sound like it. A lot of speculated info was right: the mitigations were mostly right, the video showing exploitation was real and the release of a fixed image was real. I think if you do a pre-announce, and you say that you could release it earlier or release new information and you don't, and there are reasons to inform your users, then even if it's the middle of the night for you, you should. As they stated, they are a small team and they have changed their structure, and they are learning and improving. I think if something like this happens, info is vital for us, the administrators of PHP servers
You may never hear me say this again because I am a gruff cynic who is not sure that hanging out here is good for his psyche, but thank goodness for HN. While I have been chasing around today, trying to resolve this on different servers, it turns out a three line nginx mitigation (blocking multipart uploads) I wrote in the wee small hours GMT has been quietly protecting a vulnerable machine I could not shut down (from attacks powered by every single mainstream agentic AI tool — Anthropic, OpenAI, Qwen cloud, Baidu, seemingly also AWS, Meta) Including an hour before the PHP patch actually shipped. So without the HN discussion I wouldn't have found enough people pointing at possible mitigations and I would have lost a server to this, and I thank everyone who pointed out that second mitigation in particular.
•
I'd like to express my dissatisfaction that the "big guys" are basically getting free security over getting earlier disclosure. Just saying "hey blocking multipart uploads can mitigate most of attacks early would save people so much trouble. Of course not every CVE will have workaround but many do and whole secrecy about releasing it is only to benefit of few big tech companies and nobody else
[flagged]
•
Please don't cross into personal attack. https://news.ycombinator.com/newsguidelines.html
•
There's no personal attack here. Unless your position that any statement whatsoever made in the second person that isn't a compliment is then an attack? San Francisco is a magical place where "you are doing X wrong" without slathering on six paragraphs of fake kindness constitutes some kind of personal attack
•
Well, OK then: 1) you're being rude, just stop it and get a grip 2) actually, this particular mitigation is very clearly stopping all the unusual patterns of POST request attempts I can see (it's not usually a busy server) 3) I know it is not the only mitigation that is necessary 4) … so it isn't the only mitigation I have applied 5) I am not working under a false sense of security, and I know it is temporary 6) I am not an idiot, and I am working on patching this machine, but this particular server has a unique and complicated configuration and needs a bespoke build 7) I have been prioritising much more serious risks for other people, all day, for no pay 8) again, to reiterate, you're rude.
•
Please don't respond to a bad comment by breaking the site guidelines yourself. That only makes things worse. https://news.ycombinator.com/newsguidelines.html
•
Sorry dang but I had a wider point to make there and I'm not really going to apologise this time. The rudeness is only part of what needed to be responded to. Also I have survived on too much coffee and probably too many chocolate biscuits. So actually, sorry, on reflection :-) What a day.
It is bizarre to me that servers are considered something to be “lost” in this day and age. They should as borderline ephemeral as us.
•
By "lost" I mean, it might have been broken, commandeered, exfiltrated. This is PHP world; it may be a share nothing architecture, but it's full of long-running VMs and very long-running apps.
Is it just me, or is it the truly brave that decide to deploy and protect PHP instances? Especially if WordPress or Drupal are involve? I finished moving the remainder of my stuff off of PHP and WordPress last year and haven't missed it at all. Backwards compatibility was typically pretty bad. It seemed like maintaining existing working PHP code was always a cycle of: upgrade to newer PHP, that version has breaking changes, fix that code or update to a new WordPress (plus all of the plugins that would inevitably need updating too).
•
In nearly every org I've been in or contracted to, the public landing page of the company gets a special place outside of any ops of general technical team, and is instead the work of a marketing group or a "creative" outsourcer who will default to Wordpress on PHP.
It’s scary that people haven’t been able to move uphill though.
•
I mean, this isn't a things-made-in-PHP-are-bad problem. It's a bit more a "certain C programming techniques are bad" problem. This is more like log4j, heartbleed etc. Won't be the last of these.
> from attacks powered by every single mainstream agentic AI Is it so bad? Have you measured the number of attacks? > So without the HN discussion I wouldn't have found enough people pointing at possible mitigations and I would have lost a server to this I run a tiny server. I like this server a lot. I only patched an hour after the Debian package was ready and didn't think about it again. Do you mean to imply there's a real chance my little server has been compromised? [Edit:] My server is quite public too. It hosts four SLDs and many subdomains and receives both human and bot traffic. Only one or two subdomains use PHP, but a reasonable attacker surely tries all of them.
•
> Is it so bad? Have you measured the number of attacks? It is not a torrent, no. Dozens rather than hundreds or thousands. But they would likely have succeeded! > I run a tiny server. I like this server a lot. I only patched an hour after the Debian package was ready and didn't think about it again. Do you mean to imply there's a real chance my little server has been compromised? Can't say one way or another. Have a look at your log file for POST requests in quick succession for things like /_next /_next/server /app /actions /api /dashboard > [Edit:] My server is quite public too. It hosts four SLDs and many subdomains and receives both human and bot traffic. Only one or two subdomains use PHP, but a reasonable attacker surely tries all of them. All my "obviously PHP app" domains got visited. None of my bespoke app domains (which are not obviously PHP). Though over time, the bespoke domains do get a whole bunch of boring probes for WP vulnerabilities etc., like all websites get.
•
> Have a look at your log file Surely it doesn't take a very sophisticated attacker to clean up after themselves at least a little bit ?
•
I think it doesn't, but I have to say, I have never seen an automated attack on a PHP application that has bothered to hide its traces. If your attacker is someone known to you, some kind of persistent threat, then maybe they would? But most of this stuff is typically kind of worm-like; attack one box, use it to attack another, move on. With this particular server I am in two minds about whether it is likely I have any persistent type hackers, but I must say what it looks like is automated attacks. AI script kiddies, almost. These same boxes attract all the typical PHP app probes (WP2shell etc.) And FWIW what it actually mostly looked like was hits from some sort of cloud-based AI search API; they suddenly stopped at the same time as if someone else had pulled a plug. So maybe someone running an agentic search API decided not to be part of the probes.
Turn on automatic updates.
•
but the embargo delayed the updates
That's great until you have a public zero-day exploit.
•
If it's big enough like this one you can always make an exception.
> Are there structurally much safer ecosystems out there? Several attributes make a safer ecosystem. An important one is diversity - technical diversity. For an interpreted language, the runtime is important. Python has several runtimes, as does Ruby. Javascript also has several, from the few browsers, to node, deno and bun. PHP has for all practical purposes, only one. So if there's a security incident in PHP, it affects almost all users. But when e.g. JRuby has a vulnerability, it will affect only a fraction of the installed ruby applications. For compiled languages, the tooling, libraries and runtimes is where diversity is important. With e.g. rust, the vast majority of CVEs come from libraries (crates). But since there often are several crates for a single concept, diversity helps mitigate here too.
•
...given amount of CVEs for Ruby that appears to not matter much
•
> PHP has for all practical purposes, only one. I know you added a caveat and all, but no, PHP has a number of alternative runtimes just like the other languages you mentioned: https://github.com/gakowalski/alternative-interpreters#alternative-interpreters-and-compilers But again with all the ones you mentioned, they have a "core" runtime that the vast majority of production apps use, so if NodeJS has a vulnerability it would be just as big. The interesting one will be whether "boring" ports - like recently Typescript's TSC from Typescript to Go and now to Rust - will be safer for being the same code and logic, converted to another "safer" language (by transpilers or LLMs).
it's a good point. I wonder if we'll see a PHP fork and rewrite in rust. like tcrs. given the recently issues they would seem to benefit the most...
•
There are plenty of alternative interpreters or compilers out there already, no need to start a new one again: https://github.com/gakowalski/alternative-interpreters#alternative-interpreters-and-compilers
I wonder if that isn't a side effect of how its structured... When a corporation sponsors the language, such as Java, Go, .Net, there's an inherent economic component which acts as a forcing function. PHP being a foundation sounds nice. But consensus wasn't strong enough to affect the key outcomes.
•
why nobody in foundation management was not intereated in resulta of rhe security audit? making php is the core of (checks notes) php foundation or is the management full of completely not technical people who use it to boost their CVs?
While at it, create a custom firmware for the BIOS to utilize the CPU more.
•
[delayed]
Perhaps Chainguard will be the last to receive the next bug report.
•
Given how security moguls are handling that, we should go back to "just release it, consequences be damned". Coz that gets normal people better chance of actually fixing it
> On October 21st at 07:41 UTC, more than six hours before the coordinated release, Chainguard unilaterally broke the embargo and published built images containing the fix. This is incredibly damming of Chainguard. I struggle to see justification for this, even with the chaos approaching the coordinated release.
•
There were signs that others broke the embargo too. Public (this one video everyone is talking about), but maybe also non-public. There were some rumors going around which part of PHP was affected. That was enough for some people to figure out the vulnerability. But it's also possible, that some attackers got non-public inside information. If the embargo is already broken in a meaningful way, it suddenly becomes much less clear if it is still in place after all. Emphasis on >less clear<.
I can empathize with them, this is actually quite difficult when you're an open source project. You have your source code public, so you can't commit/push because then you've leaked info. Your build pipeline is also likely public, so you can't just build from another source code... source. You can create a private repo, but now you also need to build a private build system. You don't get the same generous build resources for private repos, so you either: a) simplify the build to just the essentials b) pay Unless you have significant funding, you'll probably go for a). Now you have to maintain two systems, also with some differences between them. Plus you need a way to get the build artifacts from the private system to the public one, typically at a fixed point in time. Any failure/delay (e.g. less powerful build on private repo, errors because you exercise it rarely) causes people to get upset that you didn't respect the announced time. Maybe you're also using things like image attestation, another can of worms.
•
Linux Kernel approach of "just publish fix without fanfare" seems to be least compromising way to do it. Every bug can be security bug
Show HN: I told people I'm a convicted felon after 20 years of hiding it (buford.bg)
•
Mixed feelings about it, though appreciate you sharing. Retired at 38 also sounds way too young, not as in "good job dude" but as in you have so much life ahead of you.
•
He hit (killed?) his father on the head with a baseball bat.
•
Assault and Battery with a Deadly Weapon. Ummmm, actually, I can think of a few politicians who have been accomplices to this, or have authorized this type crime, even one more recent, on a massive genocidal scale, against foreign citizens. "All this time, no one knew that I was a convicted felon". Hmm, did he change his name, or ?
•
Show HN: I write books and stuff and have a juicy clickbait hook Good for you, mate! Less good for those nuclear secrets you may or may not have stolen and those antelopes you may or may not have sex trafficked
•
I was unable to rent apartments in San Francisco. I was unable to get a job directly after being released from prison. It's funny because when you owe the state $17,000 in restitution and you can't get a job, people become extremely desperate. And that desperation can easily put you right back into prison. It is my experience that anti-human outcomes follow a perversion of focus - when intent shifts from actually safeguarding society (thru meaningful redemption), toward destructive (zero tolerance) or exploitive ends (credit, crim reports). I suggest that serially denying paid-for redemption (fines, incarceration) forever (never ending punishment delivered via criminal records) is deeply evil.
Well it happened when they accused him of being part of a robbery that took place. So, kind of looks like it might be the first one.
•
In that first chapter, however, he discusses his relief. Even after realizing how horrific what he just did is. As someone else said, there is no chapter 2. My own guess is that it was a response to some type of long-term abuse. I can't even find a mailing list to sign up for. But I'd read the rest of this.
'I've applied for 300 jobs. My 25 years' experience is worthless' (telegraph.co.uk)
25 years in the industry and not building a social network that is able to find you a job somewhere is beyond a generational fumble
•
But obviously this only works when your network has jobs to offer in the first place. I am a well networked person and I cannot offer any help to the numerous people (who are all great, many former colleagues or even alumni who could slot right in and help us) who are reaching out to me for even just a referral. My employer has seen record breaking quarters and years and we have nothing open in engineering or even IT or support. In fact, I can already smell the blood in the water from the layoffs that are surely coming, probably shortly into 2027.
You're in SoCal. Not a tech hub. There are only several hundred tech companies in SoCal, plus another several hundred entertainment, aerospace, biotech, and defense companies... Right now, entertainment in SoCal is hurting pretty bad but the other 4 industries have hundreds of open job positions for engineering positions. The caveat is that you have to be an "engineer" and not just a "coder."
•
I know, but most of those industries treat software as a cost center, and are the first to offshore where possible. It's like me complaining about not finding good biotech employment in Chicago or lack of Aerospace work in the Bay. And traditional DefenseTech and Biotech has been conducting heavy layoffs the past few years (the former due to contract renegotiations with DoD/DoW and the latter due to the post-COVID funding crunch).
•
There are hundreds of tech job posts here per week, according to indeed anyway. Further, am willing to move for a decent job. No offers. I'd try getting an offer yourself, bet you wouldn't find it easy to even get a reply.
China might work also if they can get a visa.
•
China's tech market is tough right now, and OP doesn't have the qualifications or background to hack it in that market.
The No Kings Takedown Is Why You Shouldn't Rent Your Megaphone from Zuck (techdirt.com)
So the use of the chilling effects from the White House to eliminate speech wasn’t moderation?
•
No, that isn't what moderation is, at all. That doesn't even negate my point.
No, the argument is definitely "you have no expectation of free speech if you're using e.g. facebook to deliver that speech". Which is certainly an opinion to have, but in my view a silly one. You might as well say that if you chose to send mail using a "private company", it's that's company's "free speech right" to inspect your mail and throw it away if they don't agree with the contents.
•
Your analogy is totally ridiculous. First of all, there's a massive difference between transporting a private package from point A to point B vs hosting someone's speech on a privately owned platform and broadcasting that speech through a privately owned network, with wider consequences that do not come into play when dealing with private correspondences between parties. Next, paying a fee to a private company to ship your package confers certain obligations about what you are entitled to, when you are utilizing a privately owned platform for free, you are not entitled to anything. Finally, a private company is certainly within their rights to refuse to ship your package based on an any legal criteria they choose.
I'm not American. I chose to use American terms they have (from what I understand) the simplest definition in that it is considered absolute. Other countries have concessions for things like hate speech and other such matters (and yes, there is a lot of nuance to it). But my point was is that "free speech" is in regards to how the government treats you, not: "I can come to your business and treat you like shit and you have to sit there and take it." EDIT: I just realized you were not responding to me... oops!
•
All good. Still an interesting comment. My point (less snarkily this time) was that their definition (it's only an issue when the government limits your speech) is really quite narrow.
It's been a long time that I've had an engagement with someone with such bad faith. It's really disappointing to see it on Hacker News.
•
Ah yes, mister 50 day old account, carry on with your evasiveness. It's telling that you refuse to just follow your own logic and rationale even just a single step further.
> I'd much rather deal with information assymetries from individuals within the community Ah this must be why you're confused. You think the hazard that platforms are trying to manage is from "individuals within the community" and not, for example, foreign intelligence services. > information now accepted to be true or likely (such as that COVID most likely originated from a Chinese lab) Lmao uh oh. The mark of the terminally-online has been revealed! Hilarious how many Twitterites have come to simply believe that COVID originated from a lab over the last year or two despite zero new evidence emerging in favor of that theory, and actually tons of evidence against it emerging since then. It's almost like if read false information enough times, you'll just presume it to be true... Curious ain't it?
•
Ironically, the "new evidence" that emerged was in fact "old evidence" that was suppressed. https://www.hsgac.senate.gov/media/reps/new-doc-drop-slack-messages-reveal-proximal-origin-authors-privately-doubted-the-science-behind-their-own-paper-coordinated-with-intelligence-community-and-nih/ https://oversight.house.gov/release/classified-state-department-documents-credibly-suggest-covid-19-lab-leak-wenstrup-pushes-for-declassification/
•
Try re-reading the above comment. You are (mistakenly) substantiating it though: there has not been new evidence in favor of the lab leak in several years! You're right! Meanwhile, evidence in favor of a natural origin has continued to pile up.
What specifically on January 6th, 2021? Asking people to remain peaceful and respect law enforcment is criminal in your book? (Twitter immediately censored these tweets on that day, btw) https://x.com/realDonaldTrump/status/1346912780700577792?s=20 https://x.com/realDonaldTrump/status/1346904110969315332?s=20
•
How about the part where he was pushing Pence to certify the "alternate electors" instead of the real ones? There's a reason some of the protesters were chanting "hang Mike Pence", and it's not because they disliked his haircut.
> What has he done that is any more undemocratic than previous presidents? This is what you said, and I replied with one the most undemocratic act of a president in the USA history - literally dismissing an election result. And your reply is about my sources?
•
It’s a hoax that was fabricated by the DNC, look it up.
PHP 8.2.35 (github.com/php)
•
Is there a curl command I can use to test if the vulnerability is fully patched on a server (not merely mitigated) without causing any harm? Note I want it to work with the backports too, not just the latest version.
•
...and If you have a server in a closet still running PHP 5 or 7, hosting that project you’ll rewrite “next quarter,” this might buy you some time: https://github.com/analogic/phpsafepass
For those who can’t patch their PHP for a variety of reasons right now, here is a proxy I developed that can sit between nginx or apache and your PHP-FPM, to sanitize inputs and prevent this (and other) attacks: https://github.com/Qbix/proxy
•
Thanks for the inspiration! I've stripped down your code and made https://github.com/analogic/phpsafepass which is mostly just filter for fpm
Mr. President...
•
... a second feline has hit the stack.
Ondrej might appreciate some monetary love on a day like today. https://www.patreon.com/cw/oerdnj
•
Speaking of, the PHP PPA was pretty unusable all day. I wonder, if this was just high demand or intentional attacks on launchpad servers to prolong the exploitation window.
How is what you are describing any different than what happened today? Except the vulnerabilities were also explained. You can say that sites are getting hacked right now due to them releasing the security update. >I'm some rando so no one's even heard of me Why do think people need to have heard of you. If you are reporting this issue directly to distro maintainers, security companies, hosting companies, etc first you can help use their names as part of the marketing push to raise awareness.
•
> How is what you are describing any different than what happened today? There was an official patch within a few hours. It probably would have been a lot longer. And that was the screwup case. If today had gone correctly the official patch would have been out by the time the bug was public.
This post reads like pure slop to me
•
Honestly, who cares at this point? The slop announcements are getting more annoying than the slop.
Correct. ..did you mean to reply elsewhere perhaps?
•
Yes sorry, missed the reply link
Using thousands of AI agents to uncover new leads in biological data (openai.com)
•
Notice how it goes from "we proved Fields-medal level stuff" to "promising leads" when we go to the world of biology. Still awesome, but speaks to the limitations of pure thinking in a more applied subject. No automatic cancer cures today.
If you could press a button and obliterate the joy experienced by every professional at their work, in exchange for a 1% boost in marginal productivity for the next 2 quarters, would you do it?
•
More to the point, what if the button gives a 10% quarterly boost in productivity for the next 100 quarters. But 80% of the professionals get fired and the other 20% have harder jobs that feel more managerial. Then, yeah I would press it.
After AI more or less “solved” large parts of mathematics overnight and literally broke the internet by uncovering decades-old PHP vulnerabilities, you still think this is a hype that’s cooling off? To me, this mostly shows how much our baseline for what counts as “noteworthy” has shifted since ChatGPT came out. I’ve seen more disruptive events in the last couple of years than in the 30 before that. What would it take to get you excited again? AI discovering that aliens exist?
•
Isn’t that the point though - they’ve generated such strong results in mathematics, so why now are they delivering something so weak here? Hype rather than realistic attempts to solve things is actually a valid explanation for that. They want to give the impression it’s a solve-everything machine even if it’s not well suited to areas outside of CS and math (or really anything where the logic of what is being done is not 1:1 with syntax, which is where LLMs are clearly excelling)
If that company stopped training new models and just continued serving Opus 5.5 they'd be profitable. Being in an R&D race isn't cheap
•
For how long? If OpenAI or Google (or Chinese companies) decide to keep losing money longer than them they'll pass them pretty soon. The AI race is going to be won by whoever has enough money to burn to outlast competitors and I'm increasingly skeptical that's going to be Anthropic
 Top